A critical authentication bypass in Flowise versions prior to 3.1.0 allows unauthenticated attackers to exfiltrate sensitive OAuth credentials and internal workflow configurations.

This vulnerability is a missing authentication for critical function (CWE-306) flaw, which permits an unauthenticated attacker to interact with public chatflow configuration endpoints to extract OAuth 2.0 access tokens.

The exploitation of this vulnerability leads to unauthorized access to sensitive credential data, potentially allowing attackers to compromise connected services that rely on these OAuth tokens. With a CVSS score of 8.2, this flaw poses a High risk to organizational security, as it facilitates the exfiltration of internal workflow data and enables further lateral movement or service impersonation.

Immediate Action: Update Flowise to version 3.1.0 or later immediately to incorporate the required authentication checks.

Proactive Monitoring: Review access logs for anomalous requests directed at chatflow configuration endpoints and monitor for unexpected OAuth token refresh activity.

Compensating Controls: If immediate patching is not feasible, restrict network access to the Flowise administrative and configuration interfaces to trusted IP ranges using a firewall or reverse proxy.

Public Exploit Available: No (There is no confirmed public exploit in the available data).

Given the ease of exploitability and the potential for unauthorized access to sensitive authentication tokens, organizations should prioritize the update to Flowise 3.1.0. Failure to patch leaves the underlying large language model workflows and associated third-party service integrations exposed to credential theft.