PT-2026-52614 · Flowise · Flowise

Mbiesiad · Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2025-71335

Mitre

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2025-71335

Produtos afetados

Flowise

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-71335 · Nota de Segurança
• https://vulncheck.com/advisories/flowise-session-invalidation-failure-after-password-change · Nota
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x7rp-qj2h-ghgw · Aviso do Fabricante