Recently observed researchers reporting bugs related to a situation where a website would not invalidate secondary (separate) active session once 2FA/MFA has been enabled in primary session.
website.comhas 2FA disable.
user1logs into two separate sessions
user1enables 2FA in one of the primary session
user1reloads secondary session, to see if secondary session gets invalidated
While I do get the logic behind it, I simply do not consider it to be a valid security bug even if the secondary session does not get invalidated.
Am I missing something here? A different PoV perhaps?