Nextcloud · Report #486693
2FA Session not expires after the password reset
Validstatus
mediumseverity
$50bounty
35upvotes
18 Jan 2021disclosed
Summary
A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.