Description
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Flowise | Flowise | < 3.0.10 | 3.0.10 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise | < 3.0.10 | 3.0.10 | GHSA-x7rp-qj2h-ghgw |
References
- GitHub Security Advisory (GHSA-x7rp-qj2h-ghgw) vendor-advisory
- VulnCheck Advisory: Flowise - Session Invalidation Failure After Password Change third-party-advisory