After removing app from facebook app session not expiring.

Disclosed: 2017-08-21 13:33:08 By lilly To gratipay
Unknown
Vulnerability Details
When a user login with facebook 0Auth and then he removes the app from facebook app setting the session is not expiring. Poc:- Step1: Go to gratipay login page. Step2: Click on login with facebook 0 auth and login with facebook. Step3: Go to facebook then app setting. Step4: Now remove the gratipay app from here and go back to gratipay site. Step5: You will see that you are still logged in. Hence session is not expiring so it is vulnerable. Thanks Sushil Saini (Cyber Security Researcher)
Actions
View on HackerOne
Report Stats
  • Report ID: 129209
  • State: Closed
  • Substate: duplicate
  • Upvotes: 1
Share this report