CVE-2025-71335: Flowise - Session Invalidation Failure After Password Change
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.0.10 - Operational
After applying the Flowise upgrade to 3.0.10, invalidate/expire any existing authenticated sessions and session tokens that were created before the password change (particularly sessions with a stolen session token or a device left logged in).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71335?
The severity of CVE-2025-71335 is high with a score of 8.6.
How do I fix CVE-2025-71335?
To fix CVE-2025-71335, users should upgrade to Flowise version 3.0.10 or later.
What does CVE-2025-71335 affect?
CVE-2025-71335 affects Flowise versions 3.0.7 and earlier.
What is the main issue described in CVE-2025-71335?
CVE-2025-71335 describes a session invalidation failure after a user changes their password, allowing unauthorized access.
Who is impacted by CVE-2025-71335?
Users of Flowise who change their password without updating session tokens are at risk due to CVE-2025-71335.