Web Development
Bug Report
A customer reset their password after a phishing email, and the attacker stayed logged in
Resetting a password changed the hash but left every existing session valid, including the attacker's. We traced why, added session versioning tied to credentials, and made password changes, MFA changes and admin actions end other sessions.