Detail CWE-1466

CWE-1466

Improper Session Invalidation after Authentication Credential Change
2026-10-28
00h00 +00:00
Incomplete
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Improper Session Invalidation after Authentication Credential Change

The product provides a capability for users to change their authentication credentials, such as username or password, but it does not properly invalidate any current authenticated sessions after this authentication credential change.

Informasi Umum

Mode Pengenalan

Architecture and Design
Implementation

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Sistem Operasi

Kelas: Not OS-Specific (Undetermined)

Arsitektur

Kelas: Not Architecture-Specific (Undetermined)

Teknologi

Kelas: Client Server (Undetermined)
Kelas: Web Based (Undetermined)

Konsekuensi Umum

Cakupan Dampak Kemungkinan
AuthenticationGain Privileges or Assume Identity

Catatan: When a user changes their credentials, such as a password, they expect that the old password can no longer be used. If an adversary had previously logged in with a password that was compromised, they establish a session that was authenticated with that password and it must be invalidated on password change to prevent future compromise of the account.

Contoh yang Diamati

Referensi Deskripsi

CVE-2022-21652

session not invalidated on password change

CVE-2025-24859

session not invalidated on password change

Mitigasi yang Memungkinkan

Phases : Implementation
Ensure that user sessions are invalidated on the server-side after a change to their authentication credentials. It is important that the server-side handles all session invalidation and does not rely on the client to remove or delete a session due to the possibility of adversaries capturing session identifiers or cookies for later reuse.

Metode Deteksi

Dynamic Analysis with Manual Results Interpretation

Ensure that application testing includes scenarios where user authentication credentials are changed and verify that the previously authenticated sessions can no longer be used.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Catatan

This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases.

Referensi

REF-1567

Your Password Changed — But Your Old Sessions Didn't: The “Ghost Session” Bug (and How to Kill It)
Mr Nt.
https://medium.com/@mr.nt09/your-password-changed-but-your-old-sessions-didnt-the-ghost-session-bug-and-how-to-kill-it-0f0f7a8de6dc

REF-1568

Old Session do not invalidate after password change
Cobalt.
https://www.cobalt.io/vulnerability-wiki/v3-session-management/session-invalidate-failure-password-change

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2026-10-23 +00:00 2026-10-28 +00:00 5.0
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.