A session invalidation vulnerability exists in daptin's authentication system where JSON Web Tokens (JWTs) remain fully valid after a user changes their password. The JWT validation middleware (CheckJWT) only verifies token signature, expiry, issuer, and signing algorithm — it does not check whether the token was issued before the most recent password change. The password update code path hashes the new password but never calls InvalidateAuthCacheForEmail() and never revokes or blacklists existing tokens. This effectively negating password rotation as an incident response control.
daptin/server/jwt/jwtmiddleware.go — JWT validation without session versioningdaptin/server/resource/resource_update.go — password update without session invalidationdaptin/server/actions/action_generate_jwt_token.go — JWT claims lack password versiondaptin/server/auth/auth.go — InvalidateAuthCacheForEmail exists but not called on updatedaptin/server/resource/columns.go — password change action wiring1. JWT validation checks nothing beyond signature/expiry/issuer (jwtmiddleware.go:232-260):
// Now parse the token
parsedToken, err := jwt.Parse(token, m.Options.ValidationKeyGetter)
// Check if there was an error in parsing...
if err != nil {
m.logf("Error parsing token: %v", err)
m.Options.ErrorHandler(w, r, err.Error())
return nil, fmt.Errorf("Error parsing token: %v", err)
}
if parsedToken.Claims.(jwt.MapClaims)["iss"] != m.Options.Issuer {
return nil, fmt.Errorf("Invalid issuer: %v", parsedToken.Header["iss"])
}
if m.Options.SigningMethod != nil && m.Options.SigningMethod.Alg() != parsedToken.Header["alg"] {
// ... algorithm check
}
// Check if the parsed token is valid...
if !parsedToken.Valid {
m.logf("Token is invalid")
m.Options.ErrorHandler(w, r, "The token isn't valid")
return nil, errors.New("Token is invalid")
}
**No check exists...
0.11.8Exploitability
AV:NAC:LPR:NUI:NScope
S:UImpact
C:LI:LA:N6.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N