Summary
The application does not invalidate existing authenticated sessions after a user resets their password using the Forgot Password functionality. As a result, any active sessions established before the password reset remain valid and continue to provide access to the account.
This behavior weakens account recovery security because a password reset is generally expected to terminate all previously established sessions, preventing unauthorized users from maintaining access after the legitimate account owner regains control.
Technical Description
During testing, it was observed that resetting the account password through the password recovery workflow only updates the user's credentials. Existing session cookies or access tokens issued before the password reset remain valid and are not revoked.
If an attacker has previously obtained a valid authenticated session (through session theft, shared devices, malware, or browser compromise), they can continue accessing the victim's account even after the victim successfully changes their password.
Industry best practice recommends invalidating all active sessions and rotating authentication tokens immediately after a password reset. Amplenote's security documentation describes session tokens and OAuth access tokens, but the observed behavior indicates that existing authenticated sessions are not revoked after a password reset.
Affected Endpoint:
https:
Steps to Reproduce
Log in to a user account using Browser A.
Keep the session active without logging out.
Open Browser B or an Incognito/Private window.
Navigate to:
https:
Complete the password reset process successfully.
Log in using the newly created password in Browser B.
Return to Browser A.
Refresh the page or continue browsing.
Working Proof of Concept
Browser A
User logs into the application.
Authenticated session remains active.
Browser B
User completes the Forgot Password flow.
Password is successfully changed.
Login with the new password succeeds.
Browser A
Existing session continues to function normally.
User can still access authenticated resources without re-authentication.
Expected Result
All existing authenticated sessions should be immediately invalidated after the password reset.
Users should be required to authenticate again using the new password.
Actual Result
Existing authenticated sessions remain valid even after the password has been changed.
Attack Scenario
An attacker steals a user's session cookie through malware, browser compromise, or use of a shared/public computer.
The legitimate user notices suspicious activity and resets their password.
The attacker continues using the previously stolen session because it has not been invalidated.
The attacker retains persistent unauthorized access despite the password change.
User Impact
Unauthorized users can maintain access after a password reset.
Victims may incorrectly believe their account has been fully secured.
Sensitive notes, personal information, and account data remain accessible through existing sessions.
Business Impact
Increased risk of persistent account compromise.
Potential exposure of confidential customer information.
Loss of user trust in account recovery mechanisms.
Increased likelihood of security incidents and support requests.
Does not align with common session management best practices for password recovery workflows.
Remediation
Implement proper session invalidation immediately after a successful password reset:
Revoke all active authenticated sessions across all devices.
Invalidate all existing session cookies and refresh tokens.
Rotate session identifiers after the next successful login.
Require re-authentication on every active device.
Maintain server-side session tracking so sessions can be centrally revoked after credential changes.image.png