After removing app from facebook app session not expiring.
Unknown
Vulnerability Details
When a user login with facebook 0Auth and then he removes the app from facebook app setting the session is not expiring.
Poc:-
Step1: Go to gratipay login page.
Step2: Click on login with facebook 0 auth and login with facebook.
Step3: Go to facebook then app setting.
Step4: Now remove the gratipay app from here and go back to gratipay site.
Step5: You will see that you are still logged in.
Hence session is not expiring so it is vulnerable.
Thanks
Sushil Saini (Cyber Security Researcher)
Actions
View on HackerOneReport Stats
- Report ID: 129209
- State: Closed
- Substate: duplicate
- Upvotes: 1