A session management flaw in CubeCart v6 allows attackers to maintain unauthorized account access even after a victim has successfully changed their password.

This vulnerability, categorized as CWE-613, involves insufficient session expiration. It requires an attacker to already possess an active session, after which they can continue to interact with the account despite the legitimate user updating their credentials.

The inability to terminate existing sessions after a password reset significantly undermines security controls intended to remediate account compromises. This vulnerability carries a CVSS score of 7.1, reflecting a high risk to data confidentiality and integrity, as malicious actors can maintain prolonged access to sensitive customer or administrative data without requiring further authentication.

Immediate Action: Upgrade CubeCart v6 to version 6.5.11 or later to implement the session invalidation fix.

Proactive Monitoring: Review administrative and user session logs for suspicious activity or concurrent logins from unexpected geographic locations.

Compensating Controls: Force-terminate all active sessions manually via the database if a user reports a compromise, and implement multi-factor authentication to add a layer of protection that session hijacking alone cannot bypass.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the failure of standard password resets to secure compromised accounts, this vulnerability poses a severe risk to account integrity. Administrators must prioritize updating to version 6.5.11 to ensure that session management logic is correctly applied, thereby preventing attackers from maintaining persistent unauthorized access.