logoutClient (and clearCacheAndReload) call mx.stopClient() and then mx.logout() / deleteAllData() and reload, without ever disposing the active CallEmbed or sending HangupCall. Nothing else observes logout — callEmbedAtom is only cleared by the hangup/close echo or by the UI. So the RTC membership state event is never withdrawn and the delayed leave event is never restarted/cancelled by a still-authorised client; by the time EC's unload handler runs, the access token has already been revoked, so its leave call fails. Other participants keep seeing you in the call until the membership expires. The mic/camera also stay captured until the reload completes.
How to trigger
join a call, then Settings → Logout (or About → Clear cache and reload). Watch the room's call membership from another account.
Suggested fix
in the logout/clear-cache paths, await a best-effort hangup + callEmbed.dispose() (with a short timeout) before stopClient()/logout().
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** medium · **Type:** bug · **Confidence:** high
**Location:** `src/client/initMatrix.ts:103-134`, `src/app/state/callEmbed.ts:6-18`
### Problem
`logoutClient` (and `clearCacheAndReload`) call `mx.stopClient()` and then `mx.logout()` / `deleteAllData()` and reload, without ever disposing the active `CallEmbed` or sending `HangupCall`. Nothing else observes logout — `callEmbedAtom` is only cleared by the hangup/close echo or by the UI. So the RTC membership state event is never withdrawn and the delayed leave event is never restarted/cancelled by a still-authorised client; by the time EC's unload handler runs, the access token has already been revoked, so its leave call fails. Other participants keep seeing you in the call until the membership expires. The mic/camera also stay captured until the reload completes.
### How to trigger
join a call, then Settings → Logout (or About → Clear cache and reload). Watch the room's call membership from another account.
### Suggested fix
in the logout/clear-cache paths, `await` a best-effort hangup + `callEmbed.dispose()` (with a short timeout) before `stopClient()`/`logout()`.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:50:59 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium · Type: bug · Confidence: high
Location:
src/client/initMatrix.ts:103-134,src/app/state/callEmbed.ts:6-18Problem
logoutClient(andclearCacheAndReload) callmx.stopClient()and thenmx.logout()/deleteAllData()and reload, without ever disposing the activeCallEmbedor sendingHangupCall. Nothing else observes logout —callEmbedAtomis only cleared by the hangup/close echo or by the UI. So the RTC membership state event is never withdrawn and the delayed leave event is never restarted/cancelled by a still-authorised client; by the time EC's unload handler runs, the access token has already been revoked, so its leave call fails. Other participants keep seeing you in the call until the membership expires. The mic/camera also stay captured until the reload completes.How to trigger
join a call, then Settings → Logout (or About → Clear cache and reload). Watch the room's call membership from another account.
Suggested fix
in the logout/clear-cache paths,
awaita best-effort hangup +callEmbed.dispose()(with a short timeout) beforestopClient()/logout().Filed from the September 2026 client audit (branch
lotus@4bea4895).