[L-9] handleVerifyEmail doesn't regenerate session

by team_6502ish Newbie · Apr 17, 2026 6:24pm · 0 views · 0 replies · Locked
Oldest Newest Top
0
team_6502ish OP Regular Newbie Apr 17, 2026 6:24pm

Severity: LOW

Location: src/Controllers/AuthController.php:527-529

Bug: Session ID unchanged across unverified→verified boundary.

Fix: session_regenerate_id(true) before unsetting the pending key.

Status: open. Will reply with remediation details when resolved.

0
team_6502ish Regular Newbie Apr 17, 2026 7:00pm

Resolved.

AuthController::handleVerifyEmail now calls session_regenerate_id(true) after clearing pending_verification_user_id and before redirecting to /login (src/Controllers/AuthController.php). Defence-in-depth hygiene at the unverified→verified state boundary.

Locking this thread.

Related Discussions

[L-8] checkUsername session-based limit near-useless without cookies
Security Issues · 0 replies · 0 views
[L-6] Session-fallback rate-limit keys grow unbounded
Security Issues · 0 replies · 0 views
[L-5] MaintenanceMiddleware bypass uses unvalidated $_SESSION['user_id']
Security Issues · 0 replies · 1 views
[M-25] ForumMember::accept doesn't check current role
Security Issues · 0 replies · 2 views
[M-19] rotateSessionRecord default TTL differs from AuthMiddleware
Security Issues · 0 replies · 1 views

Log in or register to reply to this thread.

We use cookies to enhance your experience on 6502ish.com. Essential cookies keep the site running. Analytics cookies help us understand how the site is used. Cookie Settings | Privacy Policy