A session management vulnerability in nopCommerce allows unauthorized access to privileged endpoints by failing to terminate session cookies, posing a significant risk to administrative integrity.

This flaw is classified as CWE-613, Insufficient Session Expiration, where the application does not properly invalidate session tokens. An unauthenticated attacker who gains possession of a valid session cookie can leverage it to access protected areas, including the administrative interface, even after the original user has logged out.

The vulnerability carries a CVSS score of 7.1, indicating a high severity level. Successful exploitation enables unauthorized administrative access, which could lead to full system compromise, sensitive data exfiltration, or unauthorized modification of e-commerce storefront configurations. This poses a direct threat to business continuity and customer data security.

Immediate Action: Update nopCommerce to a version outside the affected ranges. Versions released after 4.70, excluding 4.80.3, contain the necessary security fixes.

Proactive Monitoring: Review web server and application logs for suspicious access patterns to the /admin endpoint, particularly sessions that persist after known logout events.

Compensating Controls: Implement strict session timeout policies and consider using a Web Application Firewall to monitor for anomalous session token reuse patterns.

Public Exploit Available: Unknown.

Given the potential for unauthorized administrative access, organizations running affected versions of nopCommerce must prioritize applying the provided vendor patches. Ensure that session management configurations are audited alongside the software update to prevent similar bypass scenarios in the future.