CVE-2025-71335 — Flowise - Session Invalidation Failure After Password Change
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already…
Published: 2026-06-25 · CVSS: 8.6 · CVSS 4.0
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7