CVE-2025-71335

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x7rp-qj2h-ghgw	Vendor Advisory Exploit
https://www.vulncheck.com/advisories/flowise-session-invalidation-failure-after-password-change	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

History

30 Sep 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Flowise anterior a la versión 3.0.10 (versiones afectadas 3.0.7 y anteriores) no invalida las sesiones existentes y los tokens de sesión después de que un usuario cambia su contraseña. Un atacante que ya posee una sesión activa, por ejemplo, a través de un token de sesión robado o un dispositivo que quedó con la sesión iniciada, permanece autenticado como el usuario legítimo incluso después de que el usuario rota sus credenciales, socavando el propósito de seguridad del cambio de contraseña.

Information

Published : 2026-06-25 22:16

Updated : 2026-10-12 21:10

NVD link : CVE-2025-71335

Mitre link : CVE-2025-71335

CVE.ORG link : CVE-2025-71335

JSON object : View

Products Affected

flowiseai

flowise

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-71335", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71335", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T17:50:37.756161Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Flowise", "product": "Flowise", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.10", "versionType": "semver"}, {"status": "unaffected", "version": "3.0.10", "versionType": "semver"}], "packageURL": "pkg:npm/flowise", "defaultStatus": "unaffected"}]}], "published": "2026-06-25T22:16:59.260", "references": [{"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x7rp-qj2h-ghgw", "tags": ["Vendor Advisory", "Exploit"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/flowise-session-invalidation-failure-after-password-change", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change."}, {"lang": "es", "value": "Flowise anterior a la versi\u00f3n 3.0.10 (versiones afectadas 3.0.7 y anteriores) no invalida las sesiones existentes y los tokens de sesi\u00f3n despu\u00e9s de que un usuario cambia su contrase\u00f1a. Un atacante que ya posee una sesi\u00f3n activa, por ejemplo, a trav\u00e9s de un token de sesi\u00f3n robado o un dispositivo que qued\u00f3 con la sesi\u00f3n iniciada, permanece autenticado como el usuario leg\u00edtimo incluso despu\u00e9s de que el usuario rota sus credenciales, socavando el prop\u00f3sito de seguridad del cambio de contrase\u00f1a."}], "lastModified": "2026-10-12T21:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDE9C759-A6B9-490A-B671-48A54B09D014", "versionEndExcluding": "3.0.10"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}