Weakness (CWE)

CWE-1466: Improper Session Invalidation after Authentication Credential Change

Variant Incomplete

The product provides a capability for users to change their authentication credentials, such as username or password, but it does not properly invalidate any current authenticated sessions after this authentication credential change.

How to prevent it (1 mitigation)

Implementation

Ensure that user sessions are invalidated on the server-side after a change to their authentication credentials. It is important that the server-side handles all session invalidation and does not rely on the client to remove or delete a session due to the possibility of adversaries capturing session identifiers or cookies for later reuse.

Source: MITRE CWE-1466

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.