Search: CVE-2026-41273

Flowise versions prior to 3.1.0 have an authentication bypass vulnerability that allows unauthenticated attackers to obtain OAuth 2.0 access tokens linked to public chatflows. By accessing a public chatflow configuration endpoint, attackers can retrieve internal workflow data including OAuth credential identifiers, enabling them to refresh and acquire valid OAuth tokens without authentication. This vulnerability is fixed in version 3.1.0.