Technical Overview
Testing a care-management platform handling sensitive patient information, we found that changing a password did not invalidate other active sessions.
We also found that logging out through the application interface did not invalidate the corresponding server-side authentication session.
The issue demonstrated that session lifecycle management was being handled primarily at the client layer rather than being enforced consistently by the backend.
Impact
An attacker with a previously obtained authentication token could retain account access after logout or password changes.
Recommendation
Implement server-side session and token revocation, use short-lived access tokens with controlled refresh mechanisms, and invalidate active sessions following password changes and other sensitive account events.
Need an assessment?
Find the weaknesses before someone else does.
Tell us what you're building, what you're protecting, or what you're concerned about. We'll help identify the appropriate security assessment.
Request an assessment