HAXcms Improper Session Termination Vulnerability in Logout Function

A vulnerability exists in HAXcms backends for Node.js and PHP, specifically in versions through 10.0.6 for Node.js and through 9.0.0 for PHP. The issue arises because the logout function fails to properly terminate a user's session or clear cookies, while also issuing a refresh token upon logout. This behavior can be exploited to access a user's account on a shared device and increases the risk of cookie-stealing attacks.

Impact

The vulnerability allows for improper session termination, potentially leading to unauthorized access to a user's account on a shared device and increased susceptibility to cookie-stealing attacks.

Remediation

Users can upgrade to HAXcms version 11.0.6 to address this vulnerability.