A revoked session that keeps working

Logging out is a promise: the credential you were using no longer works. Many products keep that promise only on the device that pressed the button. The token is self-contained and signed, the server trusts the signature, and nothing checks whether the session behind it was ended. On the screen the user is signed out; on the wire the old token still opens every door.

Why it happens

Stateless tokens are convenient because the server does not have to remember anything: it verifies a signature and reads the claims. That convenience is the weakness. Logout clears the token from the browser, but a copy taken earlier is still valid until it expires, which can be hours or days. Password change, account suspension and role downgrade have the same gap unless each one explicitly invalidates tokens already in the wild.

How the attack unfolds

An attacker who captured a token, through a logged request, a shared device, a compromised integration or a browser extension, keeps using it after the victim believes they are safe. The victim changes their password precisely because they suspect trouble, and the change does nothing to the attacker’s copy. The window is the token’s remaining lifetime, and during it the account behaves exactly as if the attacker were the owner.

A password change that leaves the attacker’s token alive is a lock changed on a door the attacker already walked through.MATT research team

Why review misses it

The logout code looks complete: it deletes the cookie and redirects. Nobody tests the token after logout, because the assumption is that logging out ends the session. The defect only appears when you keep a copy of the credential and try it again, which is a test written from the attacker’s point of view.