PT-2026-52614 · Flowise · Flowise

Mbiesiad · Published 2026-06-25 · Updated 2026-06-25 · CVE-2025-71335

Mitre

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-71335

Affected Products

Flowise

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-71335 · Security Note
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x7rp-qj2h-ghgw · Vendor Advisory
• https://vulncheck.com/advisories/flowise-session-invalidation-failure-after-password-change · Note