CODEX Disclosed Report

codex.one

On changing password both session using which user changes password and old sessions in any other browser or device does not expire and remains active

Weakness: Insufficient Session Expiration

Impact :-

Due to this bug, there is no way for the victim to revoke access of attacker if account has been already compromised

To verify the issue :

1. Log in to Browser A and make sure to check 'stay logged in to this browser' while logging in. 2.From Browser B click on forgot password and change password Notice that Session on Browser A will remain active and does not expire.

Proof Of Bug Video Link : - https://drive.google.com/file/d/1n-cMAl7z-7ef-aULewp2asY2dHhH3uWw/view?usp=sharing