The vulnerability allows a stale authentication cookie to remain valid after a user logs out, enabling anyone who has captured the session token to continue making authenticated requests on behalf of the victim until the token naturally expires. This effectively lets an attacker assume the victim’s identity without re‑authentication, potentially exposing personal data and access to the victim’s profile. The flaw stems from the server failing to invalidate the session when the client clears the auth‑token cookie.

The affected product is the open‑source design and prototyping platform Penpot, specifically all releases prior to version 2.18.0. The issue was addressed in the 2.18.0 release, which ensures that server‑side sessions are properly revoked during logout.

The CVSS score of 5.9 indicates moderate severity. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, the risk is considered moderate but not actively exploited at present. The likely attack vector involves an attacker who obtains the stale cookie through network interception, client‑side compromise, or a malicious script; the attacker can then replay the cookie to access the victim’s account until the session expires. No remote code execution or privilege escalation has been disclosed, but unauthorized access to the victim’s resources remains a concern.