Persistent AWS Authentication Cookies: A Phishing Risk That Survives Password Changes
A security researcher discovered that AWS authentication cookies remain valid for up to 12 hours even after a victim changes their password and logs out — creating a persistent access window for attackers who successfully phish credentials.