Superhuman (formerly Grammarly) · Report #667739
Previously created sessions continue being valid after MFA activation
Summary
@brdoors3 found a design issue in MFA implementation: previously created sessions aren't invalidated after MFA activation. No users affected.
Thanks, @brdoors3!
How it was found
Hi team,
I found one issue related to your 2FA system on https://account.grammarly.com/security
POC
1 access the same account on https://account.grammarly.com in two devices 2 on device 'A' go to https://account.grammarly.com/security > complete all steps to activate the 2FA system
Now the 2FA is activated for this account
3 back to device 'B' reload the page
The session still active
Impact
In this scenario when 2FA is activated the other sessions of the account are not invalidated.
2FA is required to login. I believe the expected and recommended behavior here is to terminate the other sessions> request a new login> request the 2FA code> so then give the account access again