Frédéric Guillot

Insufficient session expiration allows attackers to maintain account access because changing a password does not revoke active web sessions. An attacker with a leaked password or a copied session cookie can retain access for up to 30 days, enabling them to read integration credentials, create API keys, or register passkeys.

An unverified password change issue allows users with an active signed-in session to modify the account password without providing the current one. An attacker possessing a stolen session cookie or access to an unattended device can submit new password fields through the `updateSettings` endpoint to lock out the legitimate owner and take over the account.