Flowise before version 3.1.3 includes the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint in a whitelist that requires no authentication. This endpoint decrypts stored OAuth credentials and returns refreshed access tokens in the response. An attacker who knows a credential ID can exploit this to obtain access tokens and potentially access the victim's connected services or exhaust refresh-token quotas. The vulnerability is identified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 4.0 score of 9.2, indicating critical severity. The issue is resolved in Flowise version 3.1.3.

An attacker with knowledge of a valid credential ID can retrieve refreshed OAuth access tokens without authentication, potentially gaining unauthorized access to connected services. Additionally, the attacker can exhaust the refresh-token quota, potentially disrupting legitimate token refresh operations. This exposure of sensitive information compromises confidentiality and availability of OAuth credentials and connected services.

Upgrade Flowise to version 3.1.3 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in 3.1.3, applying this official fix is the recommended remediation. No other mitigation steps are indicated.