Flowise: Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing…
Flowise
More for Flowise RSS feed for Flowise
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Record
- CVE-2025-71335
- Affects
- Flowise
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 25, 2026
- Source last modified
- October 12, 2026
Description
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.
Description quoted from the NVD record.
Who is affected
Flowise, a tool for building apps that use AI language models, has a flaw in how it handles logins. Versions before 3.0.10 are affected, including version 3.0.7 and earlier. When a user changes their password, Flowise does not log out sessions that are already open. So an attacker who already has an active session, for example through a stolen login token or a device left logged in, stays signed in as that user even after the password change. This means changing a password does not lock out someone who already has access. This flaw is rated High.
What to do
- Find out which version of Flowise your organization uses. Versions before 3.0.10 are affected.
- If your organization installed and runs Flowise itself, the person who set it up should update it to version
3.0.10or later. - If an IT provider or vendor runs Flowise for you, send them this advisory and ask when the update will be done.
- Until the update is in place, keep in mind that changing a password in Flowise does not sign out sessions that are already open, so a password change alone will not remove someone who already has access.
Analysis written from the source record as of October 12, 2026 and reviewed before publishing.