Critical · published February 11, 2025
🚨 An improper logout implementation in Concorde could leave your credentials hanging around for thieves to grab! 🔥 Think of it like leaving your car running with the doors unlocked—anyone could jump in and take over while you think it's safely parked. Just like a shared vehicle, if multiple users use the same device, it’s crucial to ensure you’ve truly exited! An attacker could easily snatch authentication tokens left behind in cookies, allowing them to impersonate you. If you’re logged in as an admin on a shared device, this could lead to catastrophic consequences, like unauthorized access to sensitive data or controls. The potential fallout? Absolutely devastating!
Think of it like leaving your car running with the doors unlocked—anyone could jump in and take over while you think it's safely parked. Just like a shared vehicle, if multiple users use the same device, it’s crucial to ensure you’ve truly exited! This vulnerability stems from cookies not being cleared properly after logout, meaning authentication tokens linger longer than they should, leaving users exposed to attacks.
An attacker could easily snatch authentication tokens left behind in cookies, allowing them to impersonate you. If you’re logged in as an admin on a shared device, this could lead to catastrophic consequences, like unauthorized access to sensitive data or controls. The potential fallout? Absolutely devastating! Upgrade Concorde to version 12.25Q1.1 to fix this vulnerability. Additionally, for those using shared devices, head to Settings > Security and regenerate your login tokens. As a temporary fix, remember to clear cookies and site data after each session! You've got this! Follow these steps to secure your account and help keep the internet a safer place. 🛡️