Recently observed researchers reporting bugs related to a situation where a website would not invalidate secondary (separate) active session once 2FA/MFA has been enabled in primary session.


  • Consider user1 on website.com has 2FA disable.
  • user1 logs into two separate sessions
  • user1 enables 2FA in one of the primary session
  • user1 reloads secondary session, to see if secondary session gets invalidated

My brain

While I do get the logic behind it, I simply do not consider it to be a valid security bug even if the secondary session does not get invalidated.

Am I missing something here? A different PoV perhaps?

  • 3
    You need to separate the concepts of the "user" from the "user account". A user logs into account A. Another user logs into account A and enabled 2FA. Now do you see the problem?
    – schroeder
    Sep 5, 2019 at 7:45
  • 1
    @schroeder "Its all coming together". However, the applicability of such of bug would be limited I sense. Since it is going to affect only the environments where "user accounts" are shared by multiple users. I would again drag you to my original issue and request a beam of light on "other-environment" where there's no sharing of user accounts i.e. Google, Facebook, Instagram etc. Are there any other impact? Sep 5, 2019 at 8:11
  • 2
    You are also seeing this from a "normal use" angle. You need to see angles from misuse/abuse. It's not about sharing accounts. It's about someone with unauthorised access. It's about an account on one device not getting updated with the 2FA directive and then falling into someone else's hands. It's about wanting to turn on 2FA to protect your account when you lose your device, etc.\
    – schroeder
    Sep 5, 2019 at 8:44

1 Answer 1


I can see how it is considered a good practice to have upon changing authentication settings (Change password/Setup 2FA etc.) to close all of the sessions, but I don't see any real world security benefits from that.

I think that it's more important to make sure that Logout works for all sessions not just the one involved. This is meant as a close all sessions mechanism and should work accordingly.

  • I agree that the logout mechanism is more important, but I still think there aren real world benefits to invalidation. Imagine I'm logged into an important website on my phone and my laptop, and don't have 2FA enabled. Then my phone gets stolen. I don't want the thief to have access to the website, so I enable 2FA. If the session on the phone isn't invalidated, the thief still has access.
    – Ian Dunn
    Apr 17, 2023 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .