CWE-1465 Improper Session Invalidation after User Logout

The product provides a logout functionality or otherwise attempts to end an active session for a user, but it does not properly invalidate the session upon logout.

• Authentication: Gain Privileges or Assume Identity — Failure to invalidate a session on log out allows an adversary who has compromised the session more time to take action on the compromised session than is necessary.

• [Implementation] Ensure that user sessions are invalidated on the server-side after a client logs out or attempts to end their session. It is important that the server-side handles all session invalidation – including multiple tabs or windows, such as within a web browser - and does not rely on the client to remove or delete a session due to the possibility of adversaries capturing session identifiers or cookies for later reuse.

• CVE-2026-105690: Chain: auth-token was cleared on the browser after logout (CWE-602), but not revoked on the server-side (CWE-1465) • CVE-2019-12421: Chain: log out invalidated the session on the client side (CWE-602), but not the server side (CWE-1465)