CVE-2025-71335: Flowise password change fails to

CISO Take

Flowise, an open-source platform for building LLM agent workflows, does not invalidate existing session tokens when a user changes their password, so anyone who already holds a valid session — through a stolen token, a compromised device, or a shared/left-logged-in browser — stays authenticated as that user indefinitely, completely defeating the intended purpose of a credential rotation. This is a CVSS 8.1 (CWE-613, Insufficient Session Expiration) issue with a high confidentiality and integrity impact, and while EPSS sits at a modest 0.27% (top 82nd percentile, no public exploit or Nuclei template, not in CISA KEV, SSVC = TRACK), the bug is trivial to exploit once a session is already in hand and requires zero additional skill or tooling. Because Flowise instances are used to orchestrate agent workflows holding embedded LLM API keys, vector database credentials, and RAG data connections, a retained session gives an attacker standing access to build, view, or exfiltrate from those workflows well after the legitimate owner believes they've locked the account down. Patch to Flowise 3.0.10 or later immediately; until upgraded, treat any suspected session compromise as requiring a full server-side session/token wipe (not just a password reset) and review admin logs for authenticated activity from unexpected IPs following any password change event.

Sources:NVDGitHub AdvisoryEPSSCISA SSVCATLASvulncheck.com

What is the risk?

Moderate-to-high risk despite low EPSS and no known exploitation: the flaw is CVSS 8.1 (network, low complexity, low privileges, no user interaction, high confidentiality/integrity impact) and CWE-613 (Insufficient Session Expiration) is a well-understood, trivially exploitable class of bug once an attacker already possesses a session artifact. The absence of a public PoC, Nuclei template, or KEV listing lowers near-term mass-exploitation likelihood, and CISA's SSVC verdict of TRACK confirms this is not an emergency-patch-now situation for most deployments — but any organization that has had a Flowise credential incident (stolen laptop, leaked cookie, XSS elsewhere in the stack) should treat this as actively exploitable against them specifically, since the password-change 'fix' they may have already applied did not work.

How does the attack unfold?

Initial session compromise

Attacker obtains a valid Flowise session token via a stolen device, leaked cookie, or unrelated credential-theft technique.

AML.T0091

Persistence through credential rotation

Victim changes their password believing it revokes attacker access, but Flowise fails to invalidate the existing session token (CWE-613).

AML.T0091.000

Continued authenticated access

Attacker keeps using the stale session to log into the Flowise agent builder as the legitimate user with no re-authentication required.

AML.T0012

Impact: credential and workflow exposure

Attacker browses or modifies agent workflows, harvesting embedded LLM API keys and RAG datasource credentials or planting persistent malicious agent logic.

AML.T0083

Initial session compromise

Attacker obtains a valid Flowise session token via a stolen device, leaked cookie, or unrelated credential-theft technique.

AML.T0091

Persistence through credential rotation

Victim changes their password believing it revokes attacker access, but Flowise fails to invalidate the existing session token (CWE-613).

AML.T0091.000

Continued authenticated access

Attacker keeps using the stale session to log into the Flowise agent builder as the legitimate user with no re-authentication required.

AML.T0012

Impact: credential and workflow exposure

Attacker browses or modifies agent workflows, harvesting embedded LLM API keys and RAG datasource credentials or planting persistent malicious agent logic.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 32% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

Upgrade to Flowise 3.0.10 or later, which is expected to invalidate all outstanding sessions/tokens on password change. Until patched, mitigate by forcing a full logout-everywhere on any account suspected of compromise (e.g., rotating the underlying JWT/session signing secret or manually purging session store entries tied to that user ID) rather than relying on password change alone. Shorten session token TTLs and enable/require re-authentication for sensitive actions (viewing API keys, exporting flows). For detection, monitor authentication logs for session activity continuing after a password_changed_at timestamp, and alert on any Flowise API/UI access from session tokens issued before a recorded credential-reset event.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAgentFrameworkAML.T0012- Valid Accounts AML.T0083- Credentials from AI Agent Configuration AML.T0091- Use Alternate Authentication Material AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system security

NIST AI RMF

MANAGE 4.1-Post-deployment risk monitoring and response

Frequently Asked Questions

What is CVE-2025-71335?

Flowise, an open-source platform for building LLM agent workflows, does not invalidate existing session tokens when a user changes their password, so anyone who already holds a valid session — through a stolen token, a compromised device, or a shared/left-logged-in browser — stays authenticated as that user indefinitely, completely defeating the intended purpose of a credential rotation. This is a CVSS 8.1 (CWE-613, Insufficient Session Expiration) issue with a high confidentiality and integrity impact, and while EPSS sits at a modest 0.27% (top 82nd percentile, no public exploit or Nuclei template, not in CISA KEV, SSVC = TRACK), the bug is trivial to exploit once a session is already in hand and requires zero additional skill or tooling. Because Flowise instances are used to orchestrate agent workflows holding embedded LLM API keys, vector database credentials, and RAG data connections, a retained session gives an attacker standing access to build, view, or exfiltrate from those workflows well after the legitimate owner believes they've locked the account down. Patch to Flowise 3.0.10 or later immediately; until upgraded, treat any suspected session compromise as requiring a full server-side session/token wipe (not just a password reset) and review admin logs for authenticated activity from unexpected IPs following any password change event.

Is CVE-2025-71335 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71335, increasing the risk of exploitation.

How to fix CVE-2025-71335?

Upgrade to Flowise 3.0.10 or later, which is expected to invalidate all outstanding sessions/tokens on password change. Until patched, mitigate by forcing a full logout-everywhere on any account suspected of compromise (e.g., rotating the underlying JWT/session signing secret or manually purging session store entries tied to that user ID) rather than relying on password change alone. Shorten session token TTLs and enable/require re-authentication for sensitive actions (viewing API keys, exporting flows). For detection, monitor authentication logs for session activity continuing after a password_changed_at timestamp, and alert on any Flowise API/UI access from session tokens issued before a recorded credential-reset event.

What systems are affected by CVE-2025-71335?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines.

What is the CVSS score for CVE-2025-71335?

CVE-2025-71335 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelines

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0083Credentials from AI Agent Configuration

AML.T0091Use Alternate Authentication Material

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.

Exploitation Scenario

An attacker obtains an active Flowise session token — for example by finding an unlocked workstation, intercepting a token via a phishing kit, or exploiting an unrelated XSS/credential-leak elsewhere in the victim's environment. The legitimate user notices something is wrong and changes their password, believing this cuts off the attacker's access. Because Flowise never invalidates the old session, the attacker's stolen token remains fully valid; they continue logging into the agent builder, browse configured workflows to harvest embedded LLM provider keys and vector database credentials, and can silently modify agent logic to exfiltrate future data or maintain persistent backdoor access — all while appearing to the victim as if the incident has been contained.

Weaknesses (CWE)

CWE-613DEPRECATED: Insufficient Session ExpirationPrimary CWE-613DEPRECATED: Insufficient Session Expiration

CWE-613 — DEPRECATED: Insufficient Session Expiration: This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.

Source: MITRE CWE corpus.