Session Token
A credential issued by a service provider and stored locally in the browser to maintain an authenticated login state between the client and the server. The holder of a valid session token can issue requests as the account owner for the duration of the token's validity period. Exposure of a session token carries security risks comparable to those of password disclosure.
Timeline (last 90 days)
By stealing session tokens, attackers can bypass two-factor authentication (2FA) and log directly into victims' accounts.
Once a session token is hijacked, even if the account has 2FA enabled via SMS verification codes or hardware keys, it becomes useless, because authentication was already completed at the time the token was generated.
All Facts (2)
By stealing session tokens, attackers can bypass two-factor authentication (2FA) and log directly into victims' accounts.
50%UnverifiedOnce a session token is hijacked, even if the account has 2FA enabled via SMS verification codes or hardware keys, it becomes useless, because authentication was already completed at the time the token was generated.
50%