Summary

Session tokens remain valid after password change or logout violating security best practices and enables persistent session hijacking.

Affected Version: 4.4.1 (latest Docker image at time of testing - November 2025)

Details

• Password change doesn't invalidate existing sessions
• Logout only clears client-side cookie, doesn't revoke token server-side
• JWT tokens remain valid for 2 weeks regardless of password changes or logout

PoC

Token persists after logout

1. Login and capture session token
2. Logout
3. Use old token, still works

Test 2: Token persists after password change

1. Login and capture session token
2. Change password
3. Notice that the session token isn't revoked - It keeps using the same old token

Impact

Attack Scenario:

1. Attacker hijacks user's session (somehow)
2. Victim notices breach → changes his password
3. Attacker still has access via old token because tokens remain valid despite user defensive actions (until it expires after 2 weeks)

Mitigation

Implement token invalidation/revocation process → Invalidate tokens on logout or password change

References

• OWASP Session Management