High · published December 1, 2025
⚡ Your session cookies don't check out! In nopCommerce v4.70 and earlier, a logout doesn't invalidate those cookies, leaving the door wide open for session hijacking. 🔥 Think of it like leaving your house with the door unlocked after you thought you locked it; a crafty burglar could stroll right back in if they have a duplicate key, which in this case is the session cookie. Just because you've left doesn't mean the access is gone! An attacker with a valid session cookie could access privileged areas of your site, like the admin panel, even after a legitimate user has logged out. This could lead to data breaches, unauthorized changes, and a serious compromise of your online store's integrity.
Think of it like leaving your house with the door unlocked after you thought you locked it; a crafty burglar could stroll right back in if they have a duplicate key, which in this case is the session cookie. Just because you've left doesn't mean the access is gone! This vulnerability in nopCommerce allows an attacker to leverage an active session cookie after logout, bypassing intended access restrictions and resulting in unauthorized access to sensitive endpoints.
An attacker with a valid session cookie could access privileged areas of your site, like the admin panel, even after a legitimate user has logged out. This could lead to data breaches, unauthorized changes, and a serious compromise of your online store's integrity. To protect your site, upgrade nopCommerce to version 4.80.3 or any version above 4.70 that patches this issue. Additionally, ensure that session cookies are invalidated immediately upon user logout or session termination for extra peace of mind. You've got this! With these steps, your sessions will stay secure and your reputation intact! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| nopcommerce/nopcommerce | < 4.70.0 | 4.70.0 |
| nopcommerce/nopcommerce | all versions | — |