In Flowise before version 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in a whitelist of URLs that do not require authentication. This endpoint decrypts stored OAuth credentials and uses them to request refreshed access tokens from the OAuth provider, returning the refreshed access token in the response. Because no authentication is required, an attacker who knows a credential ID can retrieve valid access tokens, gaining unauthorized access to the victim's connected services and potentially exhausting the refresh-token quota. The vulnerability is identified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 4.0 score of 9.2 (critical). The issue is resolved in Flowise version 3.1.3.

An attacker with knowledge of a credential ID can obtain valid OAuth access tokens without authentication, allowing unauthorized access to connected services. Additionally, the attacker can exhaust the refresh-token quota, potentially disrupting legitimate token refresh operations. This exposure of sensitive credentials poses a critical security risk.

Upgrade Flowise to version 3.1.3 or later, where this vulnerability is fixed by requiring proper authentication for the affected endpoint. No other mitigations are indicated by the vendor advisory.