CVE-2025-71335

Katalog CVE

CVSS 8.1 · High EPSS 0,38%

Kerentanan Insufficient Session Expiration pada flowiseai flowise. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x7rp-qj2h-ghgw advisory vendor · exploit
• https://www.vulncheck.com/advisories/flowise-session-invalidation-failure-after-password-change advisory pihak ketiga