Flowise before version 3.0.10 does not invalidate existing sessions or tokens when a user changes their password. As a result, an attacker who already holds an active session remains authenticated as the legitimate user, even after credentials are rotated. The flaw, identified as CWE‑613 (Relationship Between Authentication and Session Management), enables continued unauthorized access after an expected revocation event.

The vulnerability affects Flowise Flowise installations running version 3.0.7 or earlier, before the 3.0.10 patch that implements proper session invalidation.

The CVSS score of 8.6 classifies this finding as High severity. EPSS data is not available, and the issue is not listed in CISA KEV. The likely attack vector involves an attacker who already possesses a valid session token or a device left logged in; by retaining the old token after the password change, the attacker can continue activity as the user. No additional prerequisites beyond session possession are required.