CWE-1466 Detail

CWE-1466

Improper Session Invalidation after Authentication Credential Change
2026-10-28
00h00 +00:00
Incomplete
CWE Mitre.org
Notifications for a CWE
Stay informed of any changes for a specific CWE.
Notifications manage

Name: Improper Session Invalidation after Authentication Credential Change

The product provides a capability for users to change their authentication credentials, such as username or password, but it does not properly invalidate any current authenticated sessions after this authentication credential change.

General Informations

Modes Of Introduction

Architecture and Design
Implementation

Applicable Platforms

Language

Class: Not Language-Specific (Undetermined)

Operating Systems

Class: Not OS-Specific (Undetermined)

Architectures

Class: Not Architecture-Specific (Undetermined)

Technologies

Class: Client Server (Undetermined)
Class: Web Based (Undetermined)

Common Consequences

Scope Impact Likelihood
AuthenticationGain Privileges or Assume Identity

Note: When a user changes their credentials, such as a password, they expect that the old password can no longer be used. If an adversary had previously logged in with a password that was compromised, they establish a session that was authenticated with that password and it must be invalidated on password change to prevent future compromise of the account.

Observed Examples

References Description

CVE-2022-21652

session not invalidated on password change

CVE-2025-24859

session not invalidated on password change

Potential Mitigations

Phases : Implementation
Ensure that user sessions are invalidated on the server-side after a change to their authentication credentials. It is important that the server-side handles all session invalidation and does not rely on the client to remove or delete a session due to the possibility of adversaries capturing session identifiers or cookies for later reuse.

Detection Methods

Dynamic Analysis with Manual Results Interpretation

Ensure that application testing includes scenarios where user authentication credentials are changed and verify that the previously authenticated sessions can no longer be used.

Vulnerability Mapping Notes

Justification : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comment : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Notes

This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases.

References

REF-1567

Your Password Changed — But Your Old Sessions Didn't: The “Ghost Session” Bug (and How to Kill It)
Mr Nt.
https://medium.com/@mr.nt09/your-password-changed-but-your-old-sessions-didnt-the-ghost-session-bug-and-how-to-kill-it-0f0f7a8de6dc

REF-1568

Old Session do not invalidate after password change
Cobalt.
https://www.cobalt.io/vulnerability-wiki/v3-session-management/session-invalidate-failure-password-change

Submission

Name Organization Date Date release Version
CWE Content Team MITRE 2026-10-23 +00:00 2026-10-28 +00:00 5.0
The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.