Session Fixation

Umbraco is vulnerable to Session Fixation. The vulnerability is due to a session timeout discrepancy where the Backoffice logout page displays a session timeout message before the server session expires, leading users to believe they are logged out about 30 seconds early. It allows an attacker to...