A county account settings page lets an already authenticated user change the password without re-entering the current password or completing step-up MFA. Why is this a problem if a session was stolen?
Select an answer to reveal the explanation.
Short Explanation
If someone nicks your unlocked desk badge, they should not also get to swap the door code without a second check. Password changes without re-auth or step-up MFA turn a stolen session into lasting account takeover. Logout is not the only sensitive action.
Full Explanation
Account takeover hardening requires re-authentication or MFA step-up before sensitive changes such as password or email updates. Without that gate, a stolen session cookie can permanently lock out the legitimate user. Browser cookie behavior and physical badges do not substitute for this control. Testers should report missing re-auth on sensitive settings as an authentication hygiene finding.