Executive brief
Flowise, an open-source tool for building LLM applications, fails to terminate active user sessions when a password is changed. This means that if an attacker has stolen a login token or is logged into a shared device, they will maintain full access to the account even after the legitimate owner updates their password. This flaw prevents users from effectively locking out unauthorized parties during a security breach.
Technical details
A session management vulnerability (CWE-613) exists in Flowise versions prior to 3.0.10. The application does not implement logic to revoke or rotate active session tokens upon a password change event. An attacker with an existing valid session token—obtained via session hijacking, physical access, or previous compromise—can maintain authenticated access to the system indefinitely, regardless of credential rotation. This bypasses a fundamental security control intended to remediate account compromises. The issue is resolved in version 3.0.10.
Affected products
- FlowiseAI Flowise < 3.0.10
Timeline
- 2025-11-12: advisory: Initial GitHub Security Advisory published
- 2026-06-25: disclosed: CVE published and NVD record created