# Session cookie forgery and scope

Weak or leaked signing keys, cookies not bound to subdomain, IP, or device, stale sessions surviving reset

_Area: Web authentication and account takeover. Seen in 4 disclosed reports; 4 confirmed bounties, median $1,090, range $300-$13,000; latest 2022-06-08. Updated 2026-10-23._

## How it works
A session cookie is trusted because it is signed and scoped. The assumption that breaks is that the signature key is secret and strong, and that the cookie is only valid where it was issued and for as long as the session lives. When the key is a shipped default, when the cookie is accepted on sibling subdomains, or when it is never invalidated, the cookie stops representing one user on one site and becomes a reusable credential for anyone who obtains it.

## Where it shows up
- Framework defaults left unchanged (Flask `SECRET_KEY`, `temporary_key`) [E3](https://bugbountylibrary.com/r/blog%3Aian-sh-airflow.md)
- Per-subdomain cookies accepted across other subdomains [E1](https://bugbountylibrary.com/r/h1%3A1439552.md)
- Cookies with no IP or device binding, reusable from any browser [E4](https://bugbountylibrary.com/r/h1%3A745324.md)
- Session tokens that survive logout-all or password reset, especially on auxiliary endpoints (SMS, phone lookup) [E5](https://bugbountylibrary.com/r/h1%3A390126.md)
- Auth logic that can be bypassed to impersonate a valid agent [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-kaseya-vsa-mass-msp-ransomware-incident.md)
- Tokens or cookies pasted into tickets, logs, or chat

## How to review
Check the invariant: a cookie must be unforgeable without a secret key, valid only for its issuing origin, and invalid after logout or reset. Concretely: is the signing key generated per deployment and non-default? Is the cookie's domain/path scoped to the exact subdomain, and does the server re-check the issuing host? Is there any binding to IP or device for sensitive actions? Does session reset actually invalidate old tokens on every endpoint, not just the main site? For auth-bypass paths, trace whether the identity check can be satisfied by a crafted request before reaching privileged handlers [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-kaseya-vsa-mass-msp-ransomware-incident.md).

## Variants seen
- Hardcoded default signing key enabling forged admin sessions [E3](https://bugbountylibrary.com/r/blog%3Aian-sh-airflow.md)
- Cookie not validated against issuing subdomain; service worker intercepts OAuth callback [E1](https://bugbountylibrary.com/r/h1%3A1439552.md)
- Leaked cookie reusable because unbound to IP/device [E4](https://bugbountylibrary.com/r/h1%3A745324.md)
- Stale token never expired after reset, still valid on weaker endpoints [E5](https://bugbountylibrary.com/r/h1%3A390126.md)
- Logic flaw in auth allowing impersonation of a valid agent [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-kaseya-vsa-mass-msp-ransomware-incident.md)

## Why fixes fail
Fixes that only rotate the key or expire the main session leave auxiliary endpoints and sibling subdomains trusting the old token [E5](https://bugbountylibrary.com/r/h1%3A390126.md)[E1](https://bugbountylibrary.com/r/h1%3A1439552.md). Detection that checks for a single file's presence misses the injection point behind it [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-kaseya-vsa-mass-msp-ransomware-incident.md).

## Impact and severity
Led to account takeover, access to private sites and triage inboxes, partial phone disclosure, and mass ransomware deployment [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-kaseya-vsa-mass-msp-ransomware-incident.md). Severity rises with token lifetime, cross-subdomain scope, and weak binding; median bounty $13,000.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1439552.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-kaseya-vsa-mass-msp-ransomware-incident.md
- E3: https://bugbountylibrary.com/r/blog%3Aian-sh-airflow.md
- E4: https://bugbountylibrary.com/r/h1%3A745324.md
- E5: https://bugbountylibrary.com/r/h1%3A390126.md