I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability.
The website i was testing was only using session tokens to authenticate a user, so my first question is, is it vulnerablity for a website to only check session tokens. I logged in on 2 accounts in 2 different browsers, attacker in firefox, victim in chrome, now from chrome i copied user's session token and in firfox i refreshed the url intercepted the request and replaced the session token of the attacker with victim, it logged me in victim's account could make changes in victim's account, now let me make this clear when i logout the session token expires so it was only working on active sessions, so is it a vulnerability to be able to login to someome's current active session with just a token, there were other tokens in the cookie but they were not doing anything, removing them made no difference. Now ignoring my rest of the points would you consider it a vulnerability on its own?
there was also no rate limit on how many times i could check session tokens, i checked 1000 wrong tokens and entered a right token at this the end and the response length changed so should i consider it a vulnerability that i could brute force live active sessions on a website
the length of the token was same, i tried it with different sessions, length was always same
Is it normal for a user to manipulate session token in requests is it a vulnerability? I mean is related to idor vulnerability in anyway?
There were also xss vulnerabilities that could allow me to get session token of the victim but i wanna ignore that part for now i want to understand a web application that gives access to anyone with valid session token no matter if they are on different devices with same token
Also if it is a vulnerability what would you call it?
I would also appreciate if you recommend a source to understand it better