Existing sessions valid after removing third party auth
Low
Vulnerability Details
Hi team,
I noticed an authentication break when logging in with 3rd party credentials in https://hosted.weblate.org/
POC
1 access https://hosted.weblate.org/accounts/profile/#auth> link to a Google account (for example)
2 on other device access the same account using Google credentials
3 return to the device of step 1> remove the Google account at https://hosted.weblate.org/accounts/profile/#auth> disconnect
The session remains active on the device in step 2. So I continue with a valid session from credentials not linked to any account at https://hosted.weblate.org
Please check it.
Actions
View on HackerOneReport Stats
- Report ID: 223475
- State: Closed
- Substate: resolved
- Upvotes: 3