CVE-2026-70478 is a critical authentication bypass in Flowise's OAuth2 token refresh endpoint. The /oauth2-credential/refresh endpoint was added to WHITELIST_URLS, explicitly removing authentication requirements. This was likely done to support background jobs and scheduled tasks where no active user session exists — a legitimate use case, but the implementation traded security for usability in a dangerous way.
The endpoint accepts a credential_id parameter and returns a fresh access_token in the response. There is no additional authentication beyond the credential ID itself. If an attacker can obtain or guess a victim's credential ID, they can refresh the OAuth token and gain full access to whatever service was connected — Google Drive, Slack, GitHub, or any OAuth-integrated platform.
This vulnerability is particularly severe because credential IDs appear to be enumerable or discoverable through other means: logs, error messages, API responses, or the UI. The credential ID was never designed as a secret or authorization token — it's an internal identifier. Using it as the sole gatekeeper for token refresh collapses authorization into an enumeration problem.
Before 3.1.3, check your Flowise instance: send a POST to /api/v1/oauth2-credential/refresh with a known credential_id and observe whether you receive a valid access_token in the response without any session or API key. If you can reproduce this, your instance is vulnerable. Isolate affected credentials immediately by revoking OAuth access from the connected services and re-authenticating through a patched version.
The architectural lesson is that credential IDs should never function as authorization tokens — they lack the properties needed (opacity, secrecy, session-binding). Audit any other endpoints where credential IDs gate sensitive operations. More broadly, enumerate your WHITELIST_URLS list and question every entry: each one is a decision that authentication isn't needed, and that decision compounds over time.