Flowise versions 3.0.7 and earlier do not invalidate existing sessions or session tokens after a user changes their password. This allows an attacker with an active session, such as one obtained via a stolen token or a device left logged in, to remain authenticated despite the password change. This behavior undermines the security intent of password rotation by allowing continued unauthorized access.