CVE-2025-71335
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Jun 25, 2026
Vendor
unknown
Description
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.