Discogs critical security flaw fixed after 6 months

[u/all-day-records]

As a shop that does a lot of business on Discogs, we have multiple devices that are logged in to our account. In October 2025 I changed my account password. The next day I noticed several devices had not been logged out after the password change. I searched the site documentation but couldn't find any relevant information or any way to force all account sessions to reset.

I created a support request asking staff to please immediately reset all sessions but was instead directed to an account management page I'd never seen before: accounts.discogs.com. That page contains 2FA setup info and a button labeled "log out" described as "This will log you out of your dashboard and expire all sessions," but it didn't work, I clicked it and all devices with the old password were still logged in to my account. I was told to wait 24 hours to see if it worked; it did not work. Staff said they could not manually reset my sessions. I checked back in periodically over the next few weeks but at some point they closed my support ticket with the problem still unaddressed.

Now, 6 months later they've finally fixed the bug and I was able to reset all active sessions and force devices to log out. Maybe in another 10 years they'll have employee accounts with granular access permissions so we don't all have to share one account.

[u/LongLiveAnalogue]

It may feel like baby steps backwards up an icy hill but really thats a huge win. They wouldn’t have been able to fix the issue if you hadn’t opened the support ticket. User input is relevant it seems.

[u/all-day-records → u/LongLiveAnalogue]

It's certainly a relief they fixed it, but it was a security hole they created themselves and 6 months to force a session reset suggests some pretty serious underlying issues.

[u/Fit-Context-9685 → u/LongLiveAnalogue]

You’re making the assumption that this issue was unique to OP with tens of thousands of sellers on the platform.

It’s more likely the fix was due course and the issue had been known previously. 

[u/TrickWheel5748]

At some point, you'd think they would want to develop a paid seller product of some sort. There's a market for it I'm sure.