CVE-2026-69250 describes an authorization bypass vulnerability (CWE-639) in Flowise before version 3.1.3. The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is accessible without authentication and performs server-side HTTP requests to the accessTokenUrl controlled by the credential. There are no server-side request forgery (SSRF) protections, allowing attackers to control the outbound request destination. The endpoint sends sensitive OAuth2 parameters including client_id, client_secret, grant_type=refresh_token, and refresh_token in the request body to the attacker-controlled server. The full response body from the remote server is reflected back to the caller via the tokenInfo response. This vulnerability enables unauthorized access to sensitive OAuth2 credentials and potentially sensitive data. The vulnerability is resolved in Flowise version 3.1.3.

An attacker can exploit the unauthenticated OAuth2 token refresh endpoint to cause the server to send sensitive OAuth2 credentials to an attacker-controlled server. This can lead to unauthorized access to OAuth2 tokens and potentially compromise authentication flows. The reflection of the full remote response body to the attacker allows information disclosure. The vulnerability is rated high severity with a CVSS 4.0 score of 8.5.

Upgrade Flowise to version 3.1.3 or later, where this vulnerability is fixed. Prior versions are vulnerable due to the unauthenticated token refresh endpoint and lack of SSRF protections. No other mitigations are stated in the vendor advisory.