Posted by Ron E on Aug 18
nopCommerce v4.10 and 4.80.3 is vulnerable to Insufficient Invalidation of
Session Cookies. The application does not properly invalidate or expire
authentication cookies after logout or session termination.
An attacker who obtains a valid session cookie (e.g., via network
interception, XSS, or system compromise) can continue to use the cookie to
access privileged endpoints (such as /Admin) even after the legitimate user
has logged out. This flaw…
– Read More – Full Disclosure
