{
 "id": "AIR-2026-1265",
 "slug": "cve-2026-70636-flowise-auth-bypass-vulnerability-in-oauth2-e",
 "title": "CVE-2026-70636: Flowise auth bypass vulnerability in OAuth2 endpoint",
 "summary": "An authentication bypass vulnerability in Flowise through 3.1.4 allows unauthenticated attackers to access the OAuth2 credential refresh endpoint. Attackers can trigger unauthorized token rotation across workspaces and disrupt dependent OAuth functions.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Flowise"
 ],
 "incident_date": "2026-08-06",
 "incident_date_precision": "day",
 "first_reported": "2026-08-06",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70636",
   "publisher": "NVD",
   "title": "CVE-2026-70636: Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2…",
   "published_at": "2026-08-06"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-70636",
  "auth-bypass"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}