High severity8.1NVD Advisory· Published Jun 25, 2026· Updated Oct 12, 2026
CVE-2025-71335
CVE-2025-71335
Description
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
2- github.com/FlowiseAI/Flowise/security/advisories/GHSA-x7rp-qj2h-ghgwnvdVendor AdvisoryExploit
- www.vulncheck.com/advisories/flowise-session-invalidation-failure-after-password-changenvdThird Party Advisory
News mentions
0No linked articles in our index yet.