POJIA破甲
地图 / The auth token does not expire on logging out and even after logging out all sessions

The auth token does not expire on logging out and even after logging out all sessions

身份认证 / 会话固定 / #247721

厂商
Mail.ru
严重程度
未评级
赏金
—
弱点
会话固定
研究员
—
披露日期
—
资产
—
CVE
—

该报告还没有中文解读。

时间线

暂无时间线。

阅读 HackerOne 原文 ↗作者 见原文 · 版权归作者与 Mail.ru 所有

同类报告

H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.comShopify · 2019-04-25account takeover https://idea.qiwi.com/QIWI · —Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)Shopify · 2025-09-042FA Session not expires after the password resetNextcloud · 2021-01-18 · $50CVE-2023-40273: Session fixation in Apache Airflow web interfaceInternet Bug Bounty · 2023-09-04 · $540Session fixation on public talk linksNextcloud · 2021-06-16 · $100