Session Impersonation in riders.uber.com

How it was found

Steps:

• First log in as attacker in riders.uber.com.
• Victim now opens https://login.uber.com/login in same browser (eg: net cafe).
• It asks you to enter login credentials even though another session is alive.
• If victim enters his account credentials, he will be taken to riders site.
• Even though riders domain is logged in with attacker account, it still takes him to that attacker logged in session.

Should be:

• Shouldn't show login when session is alive.
• Should have cleared old account and let new user login.

Problems:

• Serious consequences could be, user might assuming he is updating his account and may enter his credit card details in attacker account.

POC https://drive.google.com/file/d/0B9ftrLQ2j3woVktxY181U1pSMk0/view?usp=sharing (sending link as attachment is 11.X mb)

Thanks