AIKIDO-2026-665118

TL;DR

The core API's logout endpoint reads only the _token cookie to decide which credential to revoke, so a request that authenticates with an Authorization: Bearer header instead returns a normal logout response while leaving that bearer token valid. Anyone already holding a copy of the token keeps using it as the victim after the victim believes they logged out, until the token's own expiry. The gap only reaches API clients that authenticate with a bearer token rather than the browser session cookie. The fix collects every credential a request actually presented and revokes each one on logout, not just the cookie.