Session Remains Valid After Logout

Finding

A previously issued authenticated session remained usable after logout during testing.

Vendor Response

Zepto Security confirmed that the reported issue was already known and under internal tracking, and closed the report as a duplicate.

Evidence

A sanitized research visual is included below. The original session identifier and other sensitive values are intentionally excluded.

Responsible Disclosure

The report was handled through responsible disclosure and was closed as a duplicate / already-known issue according to the case-study record.