Flowise version 3.1.4 implements an authentication middleware that checks user permissions by comparing request URLs against a prefix‑based whitelist. A flaw in this matching allows any caller to append a credential identifier to the oauth2-credential refresh route and bypass both authentication and authorization checks. As a result, an unauthenticated attacker can trigger an OAuth token rotation for any workspace credential, potentially causing disruption to integrated services that rely on those tokens.

The vulnerability is present in all FlowiseAI Flowise deployments running version 3.1.4 or earlier. No specific environment or operating system is required; the flaw exists in the application code itself.

The vulnerability has a CVSS base score of 8.7, indicating high severity. EPSS is not available and the entry is not listed in CISA KEV, suggesting limited public exploitation data. Attackers can exploit the flaw by sending a POST request directly to the /oauth2-credential/refresh endpoint with an appended credential identifier, which can be performed from any network that can reach the Flowise instance. Bypassing authentication also removes authorization checks, so the attacker can target any workspace credential. The attack vector is inferred to be both local and remote, depending on network exposure of the Flowise service.