THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-r745-8hwv-h473 (high) — Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

[GHSA] GHSA-r745-8hwv-h473 (high) — Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

highgithub_advisoriesPublished 2026-08-04

GHSA-r745-8hwv-h473 Severity: high CVE: CVE-2026-69250

Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

### Summary

The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) is unauthenticated by design (it is in the public whitelist) and performs a server-side HTTP request to a credential-controlled URL (`accessTokenUrl`) w

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-69250cve
http://127.0.0.1:3000/api/v1/oauth2-credential/refresh/24c0b18b-ff6e-4d81-a9a7-26ea8ddccdefurl

Original source: https://github.com/advisories/GHSA-r745-8hwv-h473