Session Invalidation Issue in Flowise by FlowiseAI

CVE-2025-71335

What is CVE-2025-71335?

Flowise versions prior to 3.0.10 exhibit a significant security flaw where existing sessions and session tokens remain active after a user changes their password. This could allow an unauthorized attacker, who may possess a stolen session token or who may be using a device that was previously logged in, to remain authenticated as the legitimate user. Such a flaw defeats the intended purpose of password changes, potentially leading to unauthorized access and exploitation.

References