Session Remains Valid After Logout
Finding
After logout, a previously captured authenticated session cookie could be restored and accepted by the application.
Vendor Response
W3C confirmed that they were able to reproduce the issue and fixed it. They also scheduled maintenance to address non-expired SSO cookies.
Researcher Testing
Testing was performed only on the researcher's own account.
Disclosure Timeline
26 Jul 2026 — Responsible disclosure submitted to W3C.
27 Jul 2026 — W3C reproduced the issue and confirmed the fix.
Follow-up — W3C scheduled maintenance for non-expired SSO cookies.
Testing was limited to the researcher's own account.