# Stale credentials survive account state changes

Do password, email, or disable changes revoke every session, API key, and reset token?

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; 2 confirmed bounties: $500 and $4,000; latest 2026-10-26. Updated 2026-10-31._

## How it works
Authentication proves identity once; authorization then trusts whatever credential was issued. The broken assumption is that a credential's validity is tied to the account's current state. When password, email, or enabled-status changes, the system updates the account record but leaves previously issued credentials (cookies, API keys, reset tokens, streaming keys) untouched. Each credential is checked for existence and signature, not for whether the account still deserves it.

## Where it shows up
- Multiple auth stacks (legacy CGI vs newer framework routes) where only one calls an `is_enabled`/state check [E1](https://bugbountylibrary.com/r/h1%3A4000084.md)
- Disable/logout logic that deletes cookies but not API keys or group memberships [E1](https://bugbountylibrary.com/r/h1%3A4000084.md)
- Long-lived streaming/Long Poll keys issued to bots or third-party scripts [E2](https://bugbountylibrary.com/r/h1%3A337734.md)
- Password reset tokens not invalidated on email change or removal [E3](https://bugbountylibrary.com/r/h1%3A17474.md)
- Any credential store keyed by user but not versioned by account state

## How to review
For every credential type, find the validation path and confirm it checks current account state, not just credential validity. The invariant: any change to password, email, or enabled-status must invalidate all outstanding sessions, API keys, reset tokens, and streaming keys for that account. Diff parallel auth implementations line by line for the state check [E1](https://bugbountylibrary.com/r/h1%3A4000084.md). Trace disable and password-change handlers to confirm they revoke keys and memberships, not only cookies. For reset flows, confirm tokens are bound to the email they were issued for and expire on change [E3](https://bugbountylibrary.com/r/h1%3A17474.md).

## Variants seen
- API key bypassing `is_enabled` on one of two auth stacks [E1](https://bugbountylibrary.com/r/h1%3A4000084.md)
- Long Poll key/ts/server surviving password reset indefinitely [E2](https://bugbountylibrary.com/r/h1%3A337734.md)
- Reset link valid after the address was removed [E3](https://bugbountylibrary.com/r/h1%3A17474.md)

## Impact and severity
Offboarded or compromised users retained access: reading security-restricted bugs and reassigning them [E1](https://bugbountylibrary.com/r/h1%3A4000084.md), reading private messages forever [E2](https://bugbountylibrary.com/r/h1%3A337734.md), and resetting a password via a removed address [E3](https://bugbountylibrary.com/r/h1%3A17474.md). Severity rises with credential lifetime and privilege: admin or security-group access via a stale key is critical. Parallel auth stacks and bot-issued keys make it worse because revocation logic is duplicated and easily missed.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A4000084.md
- E2: https://bugbountylibrary.com/r/h1%3A337734.md
- E3: https://bugbountylibrary.com/r/h1%3A17474.md