p PatchFirst

CVE-2025-71335

CVE-2025-71335 · Flowise - Session Invalidation Failure After Password Change

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.

CVSS 8.6 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • flowise

    Versions
    • ≥ 0, < 3.0.10: Affected (semver)
    • 3.0.10: Not affected (semver)

    Update to 3.0.10

  • flowise npm

    Affected ranges
    • SEMVER: < 3.0.10

    Update to 3.0.10

Original sources

Check your server →