HexBrain

Automattic · Report #273881

Invalidate session after password reset on https://polldaddy.com

Informativestatus
12upvotes
9 Nov 2017disclosed

How it was found

Hi there, I found broken session bug on your website.Your website is unable to validate the session.That may lead takeover victims account.

Reproduce: 1.Go to https://polldaddy.com and log into your account from two different browsers. 2.Now change password from any browser you already logged in 3.You will be still logged into another browser.

Kindly fix this issue. Thx,

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original