Broken Authendication And Session Management

How it was found

Summary:

Broken Authendication And Session Management On reddit.com

Here I'm Using 2 Browsers 1.Chrome (victim Browser) 2.Firefox(attacker browser)

Steps To Reproduce:

1. Login your Account (Chrome Browser)
2. Copy Cookies
3. Paste it in firefox Browser and reload
4. you login without username and password

Supporting Material/References:

• broken auth POC.mkv

Impact

An attacker can access victim account without entering username and password