CVE-2026-56270: Flowise Information Disclosure Bug

CVE-2026-56270 Overview

CVE-2026-56270 is a missing authentication vulnerability [CWE-306] in Flowise versions prior to 3.1.0, including 3.0.13 and earlier. The /api/v1/loginmethod endpoint returns an organization's complete Single Sign-On (SSO) configuration to unauthenticated clients. A remote attacker supplies an organizationId parameter in a GET request and receives OAuth client secrets in cleartext. Affected integrations include Google, Microsoft/Azure, GitHub, and Auth0. Both FlowiseAI Cloud and self-hosted deployments are exposed when the endpoint is reachable.

Critical Impact
Unauthenticated remote attackers can harvest OAuth client secrets and SSO configuration for Google, Microsoft/Azure, GitHub, and Auth0, enabling identity provider abuse and downstream account takeover.

Affected Products

Flowise versions 3.0.13 and earlier (before 3.1.0)
FlowiseAI Cloud tenants
Self-hosted Flowise instances exposing /api/v1/loginmethod

Discovery Timeline

2026-06-24 - CVE-2026-56270 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56270

Vulnerability Analysis

The vulnerability resides in the /api/v1/loginmethod REST endpoint exposed by the Flowise application server. The handler accepts an organizationId query parameter and returns the SSO configuration associated with that organization. The route lacks any authentication or authorization middleware, so it responds identically to anonymous and authenticated callers.

The response payload contains the full provider configuration for each enabled SSO integration. OAuth client_id and client_secret values are serialized in cleartext rather than being filtered, masked, or restricted to administrators. Tenants on FlowiseAI Cloud share the same code path, so attackers can iterate through organization identifiers to enumerate cloud customers.

With valid OAuth credentials, an attacker can impersonate the Flowise application against Google, Microsoft/Azure, GitHub, or Auth0. This enables phishing flows that present a legitimate consent screen, token exchange against the identity provider, and abuse of API scopes granted to the Flowise client.

Root Cause

The root cause is a missing authentication check on a sensitive read endpoint. The route was designed to surface login options for the UI but was implemented to return secret material alongside public metadata.

Attack Vector

Exploitation requires only network reachability to the Flowise web service. The attacker sends a GET request to /api/v1/loginmethod with an organizationId parameter and parses the JSON response. No credentials, user interaction, or prior reconnaissance beyond knowing or guessing an organization identifier is required.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-6pcv-j4jx-m4vx and the VulnCheck Advisory on OAuth Disclosure. No verified proof-of-concept code is published.

Detection Methods for CVE-2026-56270

Indicators of Compromise

Unauthenticated GET requests to /api/v1/loginmethod containing an organizationId query parameter in web server or reverse proxy logs.
Requests to the endpoint from IP addresses or user agents that have not previously authenticated to the Flowise application.
Bursts of sequential or enumerated organizationId values in a short window, indicating tenant scanning.
Unexpected OAuth token issuance or consent events at Google, Microsoft/Azure, GitHub, or Auth0 referencing the Flowise client ID.

Detection Strategies

Alert on any HTTP 200 response from /api/v1/loginmethod where the requester has no associated session cookie or bearer token.
Correlate access logs with identity provider audit logs to flag OAuth client usage that does not originate from the Flowise server.
Hunt for response payloads containing client_secret or clientSecret field names returning over the network from Flowise hosts.

Monitoring Recommendations

Forward Flowise application and reverse proxy logs into a centralized analytics platform for retention and querying.
Enable identity provider logging for OAuth application credential usage and review for anomalous geographies or scopes.
Track rate of requests to /api/v1/loginmethod and baseline normal volumes per source.

How to Mitigate CVE-2026-56270

Immediate Actions Required

Upgrade Flowise to version 3.1.0 or later on all self-hosted instances.
Rotate all OAuth client secrets for Google, Microsoft/Azure, GitHub, and Auth0 integrations configured in Flowise.
Review identity provider audit logs for unauthorized authorizations or token grants tied to the Flowise OAuth clients.
Restrict network exposure of the Flowise management interface to trusted networks until patching is complete.

Patch Information

Flowise 3.1.0 addresses the vulnerability. Refer to the GitHub Security Advisory GHSA-6pcv-j4jx-m4vx for the official fix details and upgrade guidance. FlowiseAI Cloud customers should confirm with the vendor that their tenant has been remediated.

Workarounds

Block external access to /api/v1/loginmethod at a reverse proxy or web application firewall until the upgrade is applied.
Require authentication at the reverse proxy layer for all Flowise API routes.
If SSO is not in use, disable the affected integrations and clear stored OAuth credentials.

bash

# Example NGINX rule to block the vulnerable endpoint at the edge
location = /api/v1/loginmethod {
    return 403;
}