Users are occasionally switched to another user's account during an active session
Description
Users typically stay logged into their accounts for several days and use SplitPro periodically without logging out.
Twice, we observed that a user was suddenly authenticated as a completely different user without performing any login, logout, or account switch.
The issue was noticed when the user created a new expense and realized that the wrong person was automatically selected as the payer. Further investigation showed that the user was actually operating in another user's account.
It appears that the active session changes unexpectedly, although the exact cause is unknown. This has happened at least twice.
Steps to Reproduce
Unfortunately, I have not found a reliable way to reproduce the issue. It seems to occur randomly during normal usage.
Expected Behavior
A user should remain authenticated as the same account until they explicitly log out or switch accounts. Under no circumstances should one user gain access to another user's account.
Actual Behavior
Without any user interaction, an active session is unexpectedly associated with another user's account. As a result, the user can see and modify data belonging to someone else.
Screenshots
None available. The application behaves normally except that the authenticated account is incorrect.
App Version
- SplitPro: v2.1.4
- Git commit:
f0ca6d9b6a9a49e562efebd1cc0c2d8a638a9341
Environment
Android
- Device: OnePlus Nord 2T
- OS: OxygenOS 14 (Android 14)
- Browser: Chrome
- User Agent:
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36
iOS
- Device: iPhone 16 Pro
- OS: iOS 26.5.2
- Browser: Safari
The issue has been observed on both Android and iOS devices.
Severity:
This appears to be a critical authentication/session issue because users may unintentionally access another user's account and create or modify data belonging to that user.
Users are occasionally switched to another user's account during an active session
Description
Users typically stay logged into their accounts for several days and use SplitPro periodically without logging out.
Twice, we observed that a user was suddenly authenticated as a completely different user without performing any login, logout, or account switch.
The issue was noticed when the user created a new expense and realized that the wrong person was automatically selected as the payer. Further investigation showed that the user was actually operating in another user's account.
It appears that the active session changes unexpectedly, although the exact cause is unknown. This has happened at least twice.
Steps to Reproduce
Unfortunately, I have not found a reliable way to reproduce the issue. It seems to occur randomly during normal usage.
Expected Behavior
A user should remain authenticated as the same account until they explicitly log out or switch accounts. Under no circumstances should one user gain access to another user's account.
Actual Behavior
Without any user interaction, an active session is unexpectedly associated with another user's account. As a result, the user can see and modify data belonging to someone else.
Screenshots
None available. The application behaves normally except that the authenticated account is incorrect.
App Version
f0ca6d9b6a9a49e562efebd1cc0c2d8a638a9341Environment
Android
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36iOS
The issue has been observed on both Android and iOS devices.
Severity:
This appears to be a critical authentication/session issue because users may unintentionally access another user's account and create or modify data belonging to that user.