Loading HuntDB...

Existing sessions valid after removing third party auth

Low
W
Weblate
Submitted None
Reported by brdoors3

Vulnerability Details

Technical details and impact analysis

Improper Authentication - Generic
Hi team, I noticed an authentication break when logging in with 3rd party credentials in https://hosted.weblate.org/ POC 1 access https://hosted.weblate.org/accounts/profile/#auth> link to a Google account (for example) 2 on other device access the same account using Google credentials 3 return to the device of step 1> remove the Google account at https://hosted.weblate.org/accounts/profile/#auth> disconnect The session remains active on the device in step 2. So I continue with a valid session from credentials not linked to any account at https://hosted.weblate.org Please check it.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Improper Authentication - Generic