Auth bypass in Flowiseai Flowise
CVE-2026-41273
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise contains an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow. By accessing a public chatflow configuration endpoint, an attacker can retrieve internal workflow data, including OAuth credential identifiers, which can then be used to refresh and obtain valid OAuth 2.0 access tokens without authentication. This vulnerability is fixed in 3.1.0.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (36.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- Flowiseai Flowise — versions < 3.1.0
Weakness classification (CWE)
References
- github.com/FlowiseAI/Flowise/security/advisories/GHSA-6f7g-v4pp-r667 (Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-41273?
- CVE-2026-41273 is a high-severity vulnerability in Flowiseai Flowise, classified under Missing Authentication for Critical Function. CVSS score: 8.2/10. Published 2026-04-23.
- How severe is CVE-2026-41273?
- High severity. CVSS v3 base score is 8.2 out of 10.