Gener8 · Report #917213
Session not invalidated after password reset
Validstatus
mediumseverity
15upvotes
18 Aug 2020disclosed
Summary
After a user performed a password reset, all their active refresh tokens were not invalidated. This could allow an adversary with access to a valid refresh token to regain control of a victim's account, subsequent to a password reset being completed.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.