Flowise before version 3.1.0 contains a missing authentication flaw in the /api/v1/loginmethod endpoint that allows a user to retrieve an organization’s complete SSO configuration without authentication, exposing OAuth client secrets in cleartext for Google, Microsoft/Azure, GitHub, and Auth0 integrations. The disclosed secrets could be used by an attacker to impersonate the organization in third‑party services, potentially enabling further compromise or fraud. This represents a serious confidentiality breach, as the attacker gains credentials that grant API access to external services.

Vendors affected are Flowise's Flowise product where the external API endpoint is exposed, both in the cloud and self‑hosted deployments. All versions prior to 3.1.0, specifically 3.0.13 and earlier, are impacted. Upgrading to Flowise 3.1.0 or later removes the vulnerability.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote unauthenticated GET request to the exposed endpoint with a valid organizationId parameter, which an attacker could obtain by enumeration or guessing; the lack of authentication checks allows any attacker who can reach the endpoint to harvest secrets.