API Developer Portal: Active sessions not invalidated after password reset (Insecure Password Reset)

Products

• CA API Developer Portal

Issue/Introduction

During a security penetration test, it was observed that the API Developer Portal does not terminate active user sessions when a password is changed or reset.

Symptom: If a user is logged into the Portal in "Browser A" and subsequently resets or changes their password in "Browser B," the session in "Browser A" remains active and functional until it naturally expires. This behavior is flagged as an "Insecure Password Reset" vulnerability because it allows a potentially compromised session to persist despite a credential change.

Environment

API Developer Portal 5.4.x

Cause

The API Developer Portal (up to version 5.4.1) lacks a global session invalidation trigger tied to credential updates. Active session tokens are not checked against a "last credential change" timestamp during standard request authorization.

Resolution

The fix is scheduled to be included in the API Developer Portal Release 5.4.2, tentative release target for this version is the end of October 2026.

Additional Information

This issue is addressed as a defect under ID DE681959.