CVE-2026-69250

The critical failure in CVE-2026-69250 is not that developers forgot to add authentication — the advisory explicitly states the endpoint was 'unauthenticated by design.' This is a fundamentally different class of failure: a breakdown in threat modeling at the conceptual stage, not an oversight in implementation. The vulnerability fuses two dangerous primitives. First, the credentialId parameter functions as both a resource identifier and an access control mechanism — a design choice that ignores credential enumeration as a standard attacker primitive. Second, the OAuth2 refresh flow sends client_secret and refresh_token to whatever server the accessTokenUrl points to, meaning Flowise's architecture inherently trusts an attacker-controlled endpoint with highly sensitive tokens. These aren't separate concerns that happened to co-occur; the credentialId enumeration IS the authentication bypass, and the SSRF IS the consequence. You cannot meaningfully separate them in remediation. The CVSS 8.5 score undercounts the real-world exploitability. CVSS was designed for discrete vulnerabilities against discrete weaknesses — it structurally cannot capture compound primitives where the system lets you chain normal operations in an abnormal sequence. An unauthenticated endpoint with enumerable resource IDs is a critical severity event regardless of what the base CVSS says. The 3.1.3 fix warrants direct scrutiny. Was authentication added to the refresh endpoint, or was the SSRF vector simply closed? These are meaningfully different fixes with different residual risks. If the endpoint now requires authentication but still makes outbound HTTP requests to user-supplied URLs, SSRF remains possible — just narrowed. More importantly, if the underlying data model still exposes credentialIds as sequential integers with no access control semantics, the next OAuth2 feature surface will recreate this vulnerability. The real question is whether the architectural issue (trusting user-supplied URLs for sensitive token exchanges) was addressed, or just gated. This pattern is not new. The specific combination — unauthenticated endpoint, user-supplied URL, OAuth2 token exchange — appeared in API gateway tooling circa 2019-2020, in low-code integration platforms in 2021-2022, and now in Flowise. Every instance followed the same three-act sequence: developers assume 'my server talks to your server' is a trusted channel, forget both are internet-reachable, and build token exchange endpoints without considering that the URL parameter is attacker-controlled. Flowise's drag-and-drop UX doesn't just enable non-experts to deploy OAuth2 integrations — it makes credentialId enumerable by presenting it as a sequential visual node property. The enumeration isn't accidental; it's architecturally inevitable given the interface design. The blast radius extends beyond the Flowise instance. In an LLM orchestration context, OAuth2 credentials likely connect to enterprise identity providers, cloud APIs, and data sources. Capturing a refresh token from Flowise isn't the terminal impact — it's the beachhead for lateral movement into connected enterprise systems.

Reviewed through automated stages and approved by a human before publication.