Moneybird · Report #743518
Pending MFA logins aren't immediatly expired after a password change
Validstatus
lowseverity
15upvotes
10 Jul 2020disclosed
Summary
Researcher found an issue with sessions not all being terminated when password is changed.
The 2FA implementation was at fault in this scenario as the session was found to be active even after the password was changed and two-step verification was turned off.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.