Recently observed researchers reporting bugs related to a situation where a website would not invalidate secondary (separate) active session once 2FA/MFA has been enabled in primary session.


  • Consider user1 on website.com has 2FA disable.
  • user1 logs into two separate sessions
  • user1 enables 2FA in one of the primary session
  • user1 reloads secondary session, to see if secondary session gets invalidated

My brain

While I do get the logic behind it, I simply do not consider it to be a valid security bug even if the secondary session does not get invalidated.

Am I missing something here? A different PoV perhaps?

  • 3
    You need to separate the concepts of the "user" from the "user account". A user logs into account A. Another user logs into account A and enabled 2FA. Now do you see the problem?
    – schroeder
    Sep 5 '19 at 7:45
  • 1
    @schroeder "Its all coming together". However, the applicability of such of bug would be limited I sense. Since it is going to affect only the environments where "user accounts" are shared by multiple users. I would again drag you to my original issue and request a beam of light on "other-environment" where there's no sharing of user accounts i.e. Google, Facebook, Instagram etc. Are there any other impact? Sep 5 '19 at 8:11
  • 1
    You are also seeing this from a "normal use" angle. You need to see angles from misuse/abuse. It's not about sharing accounts. It's about someone with unauthorised access. It's about an account on one device not getting updated with the 2FA directive and then falling into someone else's hands. It's about wanting to turn on 2FA to protect your account when you lose your device, etc.\
    – schroeder
    Sep 5 '19 at 8:44

I can see how it is considered a good practice to have upon changing authentication settings (Change password/Setup 2FA etc.) to close all of the sessions, but I don't see any real world security benefits from that.

I think that it's more important to make sure that Logout works for all sessions not just the one involved. This is meant as a close all sessions mechanism and should work accordingly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.