A critical session management flaw in the Morelitea Initiative platform allows attackers to maintain unauthorized access to user accounts after a password reset.

This vulnerability, categorized as CWE-613, stems from insufficient session expiration where JSON Web Tokens remain valid post-password change. The flaw requires an authenticated attacker to possess a previously issued, unexpired token to access protected API endpoints.

The inability to terminate active sessions upon a security event, such as a password change, poses a significant risk to data confidentiality and integrity. If an attacker has compromised a session token, they can maintain persistent access to sensitive project management data even after the legitimate user attempts to secure their account. With a CVSS score of 8.1, this vulnerability presents a high-severity risk that could lead to unauthorized data exfiltration or administrative manipulation of project resources.

Immediate Action: Upgrade the Initiative platform to version 0.32.4 or later immediately to ensure proper JWT invalidation logic is applied.

Proactive Monitoring: Review API access logs for suspicious patterns, particularly sessions that persist long after account security changes have been performed.

Compensating Controls: Implement shorter JWT expiration times to minimize the window of opportunity for stolen tokens and consider invalidating all active sessions at the identity provider level if a compromise is suspected.

Public Exploit Available: Unknown.

Given the potential for persistent unauthorized access, upgrading to version 0.32.4 is an urgent necessity for all organizations utilizing the Initiative platform. Administrators should prioritize this update to restore the integrity of the session management system and ensure that password resets effectively terminate all active access paths.