Auth and sessions
Session survives logout or password change
Other devices stay signed in after the user logs out or changes their password.
TermsAPI (the interface other software calls; tested directly, without the UI in between) · cross-site request forgery (another site making a user's browser send a state-changing request with the user's cookies) · cross-site scripting (user-typed text rendered as markup, so a script in a name or comment runs in other users' browsers) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Logout is generated as a client-side state reset; server-side revocation across devices is a separate feature that has to be requested. Login hardening was absent across the 15-app study.
Five coding agents built 15 identical applications from the same prompts; the applications contained 69 vulnerabilities in total, every agent produced at least one server-side request forgery, none of the 15 applications had CSRF protection or security headers, and every login page shipped without rate limiting or account lockout.
Source: Tenzai, 2026-01 · verified 2026-09-21
How we detect it
Keep a second session open, log out and change the password in the first, retry a protected request.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Sessions end on logout and on password change
manual Keep a second browser signed in; log out and change the password in the first; retry a protected request in the second.
The second browser is signed out after both events.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.