THREAT - Logout will not clear all the sessions in the browser

[chenchanglew]

Scenario

When a user logs out and the user is not closing his browser (closing a single tab will not solve this issue). A malicious user can just log in without the need to input their credentials.
The adversary can change the user’s previous vote or cast another ballot under user name.
The worst thing that can happen is if the previous login account is an admin account, the malicious user can assign themselves as admin and then get admin ability.

Source

It is easy to try to reproduce this error by logging in immediately after logout. Since the browser keeps the tequila cookie then the next user can log in without inputting their credentials.

Breaking Property

Authentication, Availability, Authorization

Risk

CVSS Score: 6.4/10

Mitigation

Not yet have a solution yet because all system that use Tequilla has the same problem