Introduction

Bug bounty hunting is an exciting journey where even small observations can lead to serious security findings. In this write-up, I will explain how I discovered an account takeover vulnerability caused by improper session management on a company's website.

This article is intended to help beginners understand how simple testing techniques can uncover critical issues in web applications.

Target Overview

During my testing, I was analyzing the main website of a consumer electronics company. The website allows users to create accounts, manage their profiles, and update personal information such as email and mobile numbers.

While exploring the account functionality, I decided to test how the application handled user logout and session management.

Recon and Initial Observation

After logging into the website, I navigated to the account settings page where profile details such as email address and phone number can be modified.

Normally, when a user logs out of a web application, their session should be fully invalidated so that no sensitive pages can be accessed afterward.

However, during testing, I noticed something unusual.

Vulnerability Discovery

After logging out of the account, I pressed the browser back button to check whether previously visited pages were still accessible.

Unexpectedly, the browser displayed the account settings page again, and the system allowed interaction with the page.

This indicated that the application had not properly handled session invalidation or page caching.

Steps to Reproduce

  1. Log in to the website with a valid user account.
  2. Navigate to the account settings/profile page.
  3. Log out using the logout button.
  4. Press the browser back button.
  5. The previously visited account settings page appears again.
  6. Modify sensitive information such as email address or mobile number.
  7. Submit the changes.
  8. The system accepts the changes without asking the user to re-authenticate.

Impact

This issue could lead to several security risks:

  • Account Takeover: An attacker with temporary access to a device could modify account details.
  • Unauthorized Profile Changes: Sensitive information, such as an email address or phone number, may be altered.
  • Privacy Risks: Personal data may be exposed if the account is accessed by unauthorized users.
  • Trust & Reputation Damage: Users expect secure session handling after logout.

Root Cause

The issue occurred because the application did not properly invalidate the user session after logout and allowed sensitive pages to be cached by the browser.

Responsible Disclosure

After confirming the issue, I responsibly reported the vulnerability to the company's security team through their vulnerability disclosure program.

The report included:

  • Detailed reproduction steps
  • Impact explanation
  • Video proof of concept

Recommended Fix

To mitigate this vulnerability, the following measures were recommended:

  • Properly invalidate user sessions after logout on both server and client sides.
  • Add Cache-Control headers such as:
  • Cache-Control: no-store
  • Cache-Control: no-cache
  • Pragma: no-cache
  • Require re-authentication for sensitive actions like changing email or phone numbers.
  • Redirect users to the login page if they attempt to access protected pages after logging out.

Lessons for Beginners

This vulnerability shows that sometimes simple testing techniques can reveal critical issues.

Here are some beginner tips:

  • Always test logout functionality.
  • Use the browser back button after logging out.
  • Check whether sensitive pages remain accessible.
  • Try modifying important information after logging out.

Small tests like these can sometimes lead to high-impact findings.

Conclusion

Session management is a critical part of web application security. If the logout functionality is not handled properly, attackers may gain unauthorized access to user accounts.

For bug bounty hunters and beginners, this example highlights the importance of carefully testing authentication flows and session handling.

Even a simple action like pressing the back button can sometimes reveal serious vulnerabilities.