CVE-2025-71335
CVE-2025-71335 · Flowise - Session Invalidation Failure After Password Change
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.
CVSS 8.6 · Alta · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node