Cloudflare Public Bug Bounty · Report #1825227
Session mismatch leading to potential account takeover (local access required)
Validstatus
mediumseverity
16upvotes
10 Apr 2023disclosed
Summary
Cloudflare Dashboard and Zero Trust Dashboard share the same login mechanism for ease of use, however due to an issue with an old session management implementation, logging out from Cloudflare's Dashboard did not automatically result in the user being logged out from the Zero Trust Dashboard.
Cloudflare's Engineering Team have addressed the issue by implementing a new session management system.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.