Skip to content

Failure to Invalidate Existing Sessions After Password Change

High
HenryHengZJ published GHSA-x7rp-qj2h-ghgw Nov 12, 2025

Package

No package listed

Affected versions

<= [email protected] Latest

Patched versions

3.0.10

Description

Hi Team,

Summary

Failure to Invalidate Existing Sessions After Password Change (Persistent Session / Session Invalidity Failure)

Details

After a user changes their password, the application does not invalidate other active sessions or session tokens that were established before the change. An attacker who already has an active session (e.g., via a stolen session token, device left logged in, or other access) continues to be authenticated even after the legitimate user rotates credentials, allowing the attacker to retain access despite the user’s password change.

PoC

Repro steps:

  1. As logged in user on two browsers (ie. Chrome and Firefox, with incognito/private mode) https://cloud.flowiseai.com/account change password, on the Chrome for example
  2. Refresh the site on Firefox (second browser) - notice that still logged in (despite credentials were changed)

POC:
Steps described above (in Repro steps) completed successfully.

Impact

Persistent unauthorized access despite credential rotation - undermines the primary purpose of password changes as a remediation step.
Enables attackers with an active session (remote or physical access to a device) to continue acting as the user (confidentiality and integrity impact).
If session tokens are not bound to the credential state, forced password changes won’t terminate attacker sessions.

References
OWASP Session Management Cheat Sheet
CWE-613: Insufficient Session Expiration

Best regards,

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVE ID

No known CVE

Weaknesses

Insufficient Session Expiration

According to WASC, Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization. Learn more on MITRE.

Credits