Incident Report 15/09/2026

Start: September 14, 2026, 4:00 PM UTC+2

Identified: September 14, 2026, 5:30 PM UTC+2

End: September 15, 2026, 12:52 PM UTC+2

Reach: OAuth 2 credentials (behavior depends on credential type and the target identity server)

Impact: High — flows using affected OAuth 2 credentials can fail authentication, including Resource Owner Password (ROPC)

Description

On September 14, 2026, at 4:00 PM UTC+2, Mindflow began seeing OAuth 2 authentication failures for some credentials.

Flows that call external APIs with those credentials could not complete token exchange, so the related steps failed. Whether a flow was hit depends on the credential type (for example Resource Owner Password) and on the target identity server. Other credential types or providers may still authenticate successfully.

Cause

Mindflow upgraded OAuth 2 credential handling to support certificate-based client authentication and related security improvements. That change led to two related token-exchange failures, depending on the credential type and the target identity server.

Client authentication escaping. When Mindflow sends Client Id and Client Secret with HTTP Basic authentication, some characters that many identity servers treat as ordinary (for example - and .) were URL-escaped more aggressively than before. Some target servers do not decode that escaping the way the OAuth 2 rules expect — they compare the Client Id as a literal string — so they reject otherwise valid credentials.

Unexpected fields in a successful token response. After the same upgrade, Mindflow also validated more of the token response. Some identity servers return a successful response that still includes fields Mindflow does not need for API authentication (for example an ID token). Mindflow then rejected that response even though the server had accepted the request and returned an access token.

Impact

• Affected: flows using OAuth 2 credentials where the credential type and target server hit either path (including ROPC) — stricter Basic escaping of Client Id or Client Secret, or a successful token response that included unexpected fields.
• Symptom: token exchange does not complete; the flow step that needs that credential fails.
• Unaffected: flows whose identity servers accept the stricter escaping and return only the fields Mindflow needs, credentials that do not use that Basic authentication path, and flows that do not use OAuth 2 credentials.

Resolution

Mindflow added a compatibility layer that:

• Restores the previous, widely interoperable escaping for Client Id and Client Secret on Basic token requests, while keeping certificate support (needed because some target servers do not implement OAuth 2 client-authentication decoding correctly).
• Ignores unexpected token-response fields that are not required for API authentication, so a successful server response is no longer rejected for those extra fields.

The fix was delivered on September 15, 2026, at 12:52 PM UTC+2, which restored OAuth 2 token exchange for affected flows.

Follow-up

• Keep regression coverage for OAuth 2 Basic client authentication when Client Id or Client Secret include characters that stricter escaping would rewrite.
• Keep regression coverage for successful token responses that include fields Mindflow does not use for API authentication.
• Monitor OAuth 2 token exchange success after the fix.