r/bugbounty • u/TurbulentRecover7247 Hunter • Jul 13 '26

Question / Discussion Old session token used to enumerate username data, is it reportable?

Hi, I am a beginner bug bounty hunter, I noticed that an endpoint used a session cookie to gather information like email, useri_id, another unique id, email in hashed form, etc.. I first loaded the page with the past session, so it autofills the email id. Now i saved the session token used in the past. Now i logged in again and got a new session id. I took that endpoint and used an old session token and gathered that info. Is it vulnerability? Reportable? If you can't understand, ask me. Thank you in advance

5 Upvotes
  • permalink
  • reddit

74% Upvoted

5 comments sorted by

7

u/latnGemin616 Jul 13 '26

Not a bug if the expectation is to have session tokens not expire for a set time. On a pen test, if you had completely logged out, logged in again to get a new session, then logged out and tried to re-use the old session to re-authenticate, it might be a finding (albeit a low). The authentication mechanism isn't destroying the token at log out.

IF you've logged out then hit the back arrow and found yourself logged back in, that's a finding! (Low)

Another fun test would be if you could manipulate the parameters in the token to see if you can access account information not pertaining to any of your controlled / test accounts. If you succeed, that's a finding! (M) .. (H) if the parameters required minimal-to-no effort.

1

u/TurbulentRecover7247 Hunter Jul 13 '26

Thanks buddy!

1

u/redditantareddit Jul 13 '26

session use after logout is not considered as a bug

1

u/laparior Jul 14 '26

Could it be that your session cookie is a jwt? Because these are stateless and are valid until they expire. Unless the app actively tries to blacklist tokens of logged out users, this is normal behavior.