The session management in the 2FA-enabled parameter is broken in the web application. Sessions are not invalidated once the 2FA enabled is enabled internally from the account. A user can browse the web application with two sessions.
The system exhibits a critical vulnerability related to session management & the absence of proper session expiration when a user disables two-factor authentication (2FA) on their account. This vulnerability poses a substantial security risk by allowing an attacker to maintain an active session even after the 2FA layer has been disabled.
DESCRIPTION:
Session management is a cornerstone of secure application usage, ensuring that user sessions are appropriately managed & terminated to prevent unauthorized access. In this context, the lack of session expiration when users disable 2FA poses a significant risk. Malicious actors exploiting this vulnerability could potentially gain unauthorized access to accounts without the secondary layer of protection provided by 2FA.
Steps to reproduce:
1) Log in to the web application from two web browsers
2) Go to the web page of 2FA enabled from any one browser
3) Enable the 2FA enabled.
4) Session from another browser is still valid.
Please ensure that all active sessions are automatically terminated when two-factor authentication (2FA) is enabled similar to how sessions are invalidated upon a password reset.
I strongly recommend addressing this vulnerability immediately to safeguard user accounts & sensitive data. Implementing proper session expiration controls that account for changes in user authentication settings...