[www.drive2.ru] Insufficient Session Expiration - Previously issued email change tokens do not expire upon issuing a new email change token

Summary

The email verification code was not expired when a new one was generated. It was fixed.

Summary

When a user changes their email, they can receive a verification code in the changed email. This verification code will be used when changing your email.

but, drive2.ru can reuse a corrupted verification code because the previously issued email change verification code does not expire when a new email change verification code is issued due to improper session expiration.

Risk

There are currently no immediate security risks. However, according to OWASP, old sessions must expire when requesting a new session, so it may be best security practice to expire old unused verification codes when issuing a new verification code.