Can you explain this vulnerability to me?

This vulnerability exists in Memos, a note-taking service that uses Access Tokens for authentication. When a user changes their password, the existing Access Tokens remain valid instead of being revoked. This means that if an attacker has compromised an account and obtained an Access Token, changing the password does not invalidate the attacker's token. The attacker can continue to access the account until the user manually deletes the attacker's Access Token. Additionally, the Access Tokens have generic descriptions, making it difficult to identify malicious tokens. The proper fix would be to revoke all Access Tokens when a password is changed, forcing re-authentication.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can allow an attacker who has obtained an Access Token to maintain unauthorized access to a user's account even after the user changes their password. This undermines the security of the account, potentially exposing sensitive notes or data stored in Memos. The user must manually identify and delete the attacker's Access Token to regain full control, which can be difficult due to generic token descriptions.

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, users should manually delete any suspicious or unknown Access Tokens from their account after changing their password, as changing the password alone does not invalidate existing tokens. Additionally, it is recommended to revoke all Access Tokens when a password is changed to ensure all sessions are logged out and require re-authentication. Since a patched version is not yet available, manual token management is necessary to secure accounts.

Useful 0 Not Useful 0