CVE-2026-56270: Flowise Unauthenticated OAuth Secret Exposure – HIGH Severity

Technical summary

The vulnerability resides in the /api/v1/loginmethod endpoint, which lacks proper authentication checks (CWE-306: Missing Authentication). When an unauthenticated user sends a GET request with an organizationId parameter, the endpoint returns the complete SSO configuration for that organization in cleartext, including sensitive OAuth client IDs, client secrets, and token endpoints. This design flaw treats SSO metadata as publicly readable information rather than protecting it as a sensitive security control. The vulnerability affects self-hosted Flowise instances and FlowiseAI Cloud deployments where this endpoint remains accessible without authentication barriers. The issue was present in versions 3.0.13 and earlier, with remediation available in version 3.1.0.

Business impact

Compromise of OAuth client secrets is catastrophic for identity security. An attacker with these credentials can impersonate your Flowise application to OAuth providers, potentially gaining unauthorized access to user accounts and data flowing through your identity infrastructure. For organizations using Flowise as a central automation hub integrating multiple SaaS applications, this creates a lateral movement opportunity—attackers can pivot from stolen credentials to compromise downstream applications that trust your Flowise instance as an authentication source. The exposure is particularly severe if Flowise is integrated with internal systems or manages authentication for sensitive workflows. Additionally, the breach of multiple OAuth secrets (Google, Microsoft, GitHub, Auth0) in a single request multiplies the attack surface and complicates incident response.

Affected systems

Flowise versions 3.0.13 and earlier are vulnerable. This includes both self-hosted deployments and FlowiseAI Cloud instances. The vulnerability is only exploitable if the /api/v1/loginmethod endpoint is network-accessible; air-gapped or network-restricted deployments have reduced risk. Organizations should verify their Flowise version and check whether the loginmethod endpoint is exposed to untrusted networks. Cloud-hosted instances may have been automatically patched depending on the provider's update cadence; self-hosted users must manually upgrade.

Exploitability

Exploitation requires no special access, no user interaction, and no authentication. An attacker only needs to know or guess an organization ID and send a single GET request. The vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector, low complexity, and high confidentiality impact. While the vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities catalog, the simplicity of the attack—no authentication, straightforward HTTP GET—makes it trivial to weaponize. Automated scanners can rapidly enumerate Flowise instances and test for this flaw. The barrier to exploitation is exceptionally low, making this a high-priority remediation target despite not being actively exploited in the wild at publication.

Remediation

Upgrade to Flowise version 3.1.0 or later immediately. Verify the upgrade with your vendor or release notes to confirm authentication controls have been added to the /api/v1/loginmethod endpoint. In the interim, network-level mitigations include restricting access to the /api/v1/loginmethod endpoint using a web application firewall, reverse proxy, or network segmentation to allow only trusted internal clients. Monitor your SSO provider (Google, Microsoft, Auth0, GitHub) for any suspicious token usage or unauthorized application access, and consider rotating OAuth credentials if you cannot immediately patch. Disable Flowise API access from untrusted networks if it is not required for external integrations.

Patch guidance

Flowise version 3.1.0 introduces authentication validation on the /api/v1/loginmethod endpoint. Before upgrading, verify your current version with `flowise --version` or check your deployment configuration. If running self-hosted Flowise via Docker, update to the latest image tag and redeploy. If using FlowiseAI Cloud, check your account dashboard for update notifications; cloud instances may be automatically patched but should be verified. After upgrading, test that the /api/v1/loginmethod endpoint now requires authentication and returns an error or empty response when accessed without credentials. Retain OAuth secrets rotation as part of post-incident remediation even after patching, as any historical exposure should be assumed compromised.

Detection guidance

Search logs for GET requests to `/api/v1/loginmethod` from external or unexpected IP addresses, particularly those without corresponding authentication events. Monitor for HTTP 200 responses from this endpoint when no authentication token is present in the request headers. If your Flowise instance logs requests, check for patterns of organizationId enumeration (sequential or bulk ID testing). Examine OAuth provider access logs (Google Cloud, Microsoft Entra ID, GitHub, Auth0) for unexpected token usage, application authorizations, or login activity from unfamiliar IP addresses or locations that do not match your organization's usage patterns. For cloud-hosted Flowise, review API access logs for unauthenticated endpoint calls. If Flowise logs are available, search for loginmethod endpoint access and correlate with authentication state to identify successful unauthorized calls.

Why prioritize this

This vulnerability warrants immediate remediation despite not being on CISA's Known Exploited Vulnerabilities list. It combines a trivial exploitation path (unauthenticated network access, no user interaction) with catastrophic impact (exposure of OAuth client secrets affecting multiple identity providers). The lack of complexity barriers and the high value of stolen credentials make this an attractive target for opportunistic attackers and adversaries conducting reconnaissance. Organizations running Flowise in internet-facing deployments are at severe risk of compromise. The fix is straightforward (upgrade to 3.1.0), making delay unjustifiable. If your organization uses Flowise for critical workflows or identity orchestration, treat this as a critical priority.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the combination of network accessibility, no authentication requirement, low complexity, and high confidentiality impact. While the vulnerability does not enable direct system compromise or data manipulation (integrity and availability are unaffected), the exposure of OAuth secrets creates a severe downstream risk. The score appropriately does not account for environmental factors such as business criticality or the number of dependent applications, which may justify even higher internal prioritization. The absence of active exploitation does not reduce the urgency; the ease of discovery and weaponization makes this a proactive target for attackers.

Frequently asked questions