CVE-2025-71335
CVE-2025-71335 · Flowise - Session Invalidation Failure After Password Change
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.
CVSS 8.6 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node