Hiro · Report #716647
Invalidate active sessions after password change
Informativestatus
lowseverity
9upvotes
31 Oct 2025disclosed
Summary
The Blockstack browser does not use traditional user sessions. Rather, each user session is entirely decentralized -- no remote server "manages" a session. Because of this, two user sessions in two different browsers are completely independent. One cannot change the password of the other.
Because of this, we do not believe that "session not expiring after password change" is a bug or a vulnerability.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.