Session token stored in world-readable preferences survives logout
- Affected asset
- SharedPreferences file auth.xml in the Android package
- Rating
- High Possible 3 × Severe 5 = 15
Description
The app writes the session token to an unencrypted preferences file and does not clear it on logout. On a rooted device, or through a backup, the token can be recovered and replayed to impersonate the user, even after they believe they have signed out.
Evidence
$ adb shell run-as au.com.example.app \
cat shared_prefs/auth.xml
<map>
<string name="session_token">eyJhbGciOiJIUzI1NiIs...</string>
<long name="issued_at">1757030400000</long>
</map>
# file persists after the user taps Log out
The session token was readable in plain text and remained on the device after the user had logged out.
Impact
Anyone with access to the device, physically or through malware, can recover a valid session and act as the user. Because the token is not cleared on logout, a shared or resold device leaks the previous user's session to the next person to hold it.
Remediation
Store tokens in the platform keystore, the Android Keystore or the iOS Keychain, not in preferences or files. Clear all credentials and tokens on logout, set a server-side session lifetime, and exclude sensitive data from device backups.