Flowise versions prior to 3.0.10 do not invalidate existing active sessions after a user changes their password. This allows an attacker with an active session token or access to a logged-in device to maintain access even after the legitimate user rotates their credentials. The vulnerability undermines the security benefit of password changes by permitting persistent unauthorized access. A fix is available in version 3.0.10.