Submission File: ES2604-a5ac90a6-new-use-unbound-reusable-authentication-artifact.txt
ID: ES2604-a5ac90a6
SUBMISSION DATE: 2026-04-03 13:39:04
NAME: Use of Unbound, Reusable Authentication Artifact
DESCRIPTION:
The product authenticates users solely based on possession of a single
reusable authentication artifact (e.g., cookie, token, or session
identifier) issued after successful authentication, including username,
password, and multi-factor verification. Because the artifact alone is
sufficient to gain access, no additional verification or contextual binding
is required, creating a single point of failure.
If the artifact is compromised or stolen, an attacker can immediately
impersonate the user across multiple devices and applications without
requiring the user's credentials or additional authentication factors. This
risk is particularly significant in environments such as single sign-on
(SSO) or multi-application platforms, where the same artifact may grant
access across several services.
Subtle variations include:
The artifact is valid across multiple sessions, devices, or applications
without scope restriction
Lack of binding to device, session, or contextual parameters
No server-side invalidation across concurrent sessions upon logout
Reuse of the artifact enables simultaneous access across contexts
Technical impact: account takeover, unauthorized access, session hijacking,
elevated blast radius, and immediate compromise of all systems that trust
the artifact.
Submission File: ES2604-a5ac90a6-new-use-unbound-reusable-authentication-artifact.txt
ID: ES2604-a5ac90a6
SUBMISSION DATE: 2026-04-03 13:39:04
NAME: Use of Unbound, Reusable Authentication Artifact
DESCRIPTION:
The product authenticates users solely based on possession of a single
reusable authentication artifact (e.g., cookie, token, or session
identifier) issued after successful authentication, including username,
password, and multi-factor verification. Because the artifact alone is
sufficient to gain access, no additional verification or contextual binding
is required, creating a single point of failure.
If the artifact is compromised or stolen, an attacker can immediately
impersonate the user across multiple devices and applications without
requiring the user's credentials or additional authentication factors. This
risk is particularly significant in environments such as single sign-on
(SSO) or multi-application platforms, where the same artifact may grant
access across several services.
Subtle variations include:
The artifact is valid across multiple sessions, devices, or applications
without scope restriction
Lack of binding to device, session, or contextual parameters
No server-side invalidation across concurrent sessions upon logout
Reuse of the artifact enables simultaneous access across contexts
Technical impact: account takeover, unauthorized access, session hijacking,
elevated blast radius, and immediate compromise of all systems that trust
the artifact.