GHSA-qgvm-j2hm-6m38

### Summary

The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) is in `WHITELIST_URLS`, meaning it requires **no authentication**. It decrypts the stored credential (containing `clientId`, `clientSecret`, `refresh_token`), sends a refresh request to the configured OAuth provider, and returns the new `access_token` directly in the response body.

### Root Cause

```typescript // packages/server/src/routes/oauth2/index.ts:393-402 res.json({ success: true, message: 'OAuth2 token refreshed successfully', credentialId: credential.id, tokenInfo: { ...tokenData, // ← includes access_token! has_new_refresh_token: !!tokenData.refresh_token, expires_at: updatedCredentialData.expires_at } }) ```

Whitelist entry at `packages/server/src/utils/constants.ts:40`.

### Attack Chain

1. Attacker obtains a credential ID (via Finding 2 / public chatflow leak, or enumeration) 2. Attacker calls `POST /api/v1/oauth2-credential/refresh/:credentialId` (no auth required) 3. Server decrypts credential, sends refresh request to OAuth provider with user's `client_secret` 4. Server returns the new `access_token` in the response to the attacker 5. Attacker uses the token to access the victim's connected service (Google, Microsoft, etc.)

### Docker Validation

`POST /api/v1/oauth2-credential/refresh/fake-uuid` returns `{"message":"Credential not found"}` (not 401 Unauthorized), proving the endpoint processes the request without authentication.

### Impact

- OAuth2 access token theft for any connected service - Full access to the victim's third-party accounts (Google, Microsoft, GitHub, etc.) - Client secret transmitted to OAuth provider during refresh - Can also be used for DoS by exhausting refresh token quota

### Suggested Fix

Remove the refresh endpoint from `WHITELIST_URLS` and require authentication:

```typescript // Remove from WHITELIST_URLS in constants.ts // Add authentication check in the route handler ```

---

## Credits

- Shinobi Security - https://github.com/shinobisecurity