CVE-2026-70636 is an authentication bypass vulnerability in Flowise through version 3.1.4. The flaw arises from prefix-based whitelist matching in the authentication middleware located in packages/server/src/utils/constants.ts. Attackers can send a specially crafted POST request to the oauth2-credential refresh route with a trailing credential identifier, bypassing all authentication and authorization checks. This allows unauthorized rotation of OAuth tokens for credentials belonging to any workspace, which may disrupt dependent OAuth integrations. This vulnerability is a bypass of CVE-2026-41273.

Unauthenticated attackers can bypass authentication and authorization controls to trigger OAuth token rotation for any workspace's credentials. This can disrupt OAuth integrations that rely on these credentials, potentially causing denial of service or unauthorized access to integrated services. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating it is exploitable remotely without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the OAuth2 credential refresh endpoint and monitor for unusual POST requests targeting this route. Avoid exposing the service to untrusted networks and consider implementing additional access controls or network-level restrictions to mitigate exploitation risk.