CVE-2025-71335 Flowise CVE debrief

Who should care

System administrators and security professionals responsible for managing and securing Flowise installations should be aware of this vulnerability. Given the high CVSS score of 8.6, indicating a high level of severity, immediate attention is required to ensure that Flowise instances are upgraded to a secure version. Additionally, defenders should review their current session management practices and verify that appropriate measures are in place to detect and respond to potential exploitation attempts.

Technical summary

The vulnerability in Flowise arises from its failure to properly invalidate existing user sessions and session tokens upon a password change. Normally, when a user changes their password, the system should invalidate all existing sessions and session tokens associated with that user's account to prevent unauthorized access. However, in Flowise versions prior to 3.0.10, this invalidation process does not occur, leaving active sessions and tokens valid even after a password change. This means an attacker who has gained access to a valid session token, perhaps through theft or by exploiting another vulnerability, can continue to use that token to authenticate as the user who changed their password. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, reflecting a high impact on confidentiality and integrity.

Defensive priority

High priority should be given to upgrading Flowise to version 3.0.10 or later, as this version addresses the session invalidation issue. Additionally, defenders should consider reviewing their Flowise configurations and user sessions to identify any potential unauthorized access.

Recommended defensive actions

• Upgrade Flowise to version 3.0.10 or later to fix the session invalidation vulnerability.
• Review current Flowise user sessions for any suspicious activity.
• Implement additional monitoring to detect potential exploitation attempts.
• Consider rotating all user passwords and invalidating existing sessions as a precautionary measure.
• Verify that all Flowise instances are running with the latest security patches and updates.

Evidence notes

The CVE-2025-71335 vulnerability details were obtained from the National Vulnerability Database (NVD) and the Flowise security advisory. The vulnerability affects Flowise versions 3.0.7 and earlier. The CVSS score of 8.6 indicates a high severity level. There is no evidence of public exploitation or ransomware campaign use at this time.

Official resources