Existing sessions valid after removing third party auth

Disclosed: 2017-06-16 14:16:34 By brdoors3 To weblate
Low
Vulnerability Details
Hi team, I noticed an authentication break when logging in with 3rd party credentials in https://hosted.weblate.org/ POC 1 access https://hosted.weblate.org/accounts/profile/#auth> link to a Google account (for example) 2 on other device access the same account using Google credentials 3 return to the device of step 1> remove the Google account at https://hosted.weblate.org/accounts/profile/#auth> disconnect The session remains active on the device in step 2. So I continue with a valid session from credentials not linked to any account at https://hosted.weblate.org Please check it.
Actions
View on HackerOne
Report Stats
  • Report ID: 223475
  • State: Closed
  • Substate: resolved
  • Upvotes: 3
Share this report