useSessionSync() is mounted only inside ClientRoot, i.e. only in the authenticated shell.
A tab parked on the login/register/OIDC-callback pages never subscribes, so when another tab completes
a login that tab keeps showing the login form and, if the user submits it, starts a second
device/session for the same account. The symmetric case (logout in tab A while tab B is authenticated)
is handled correctly.
How to trigger
open two tabs at the login screen, sign in on tab A, switch to tab B — it still shows the form.
Suggested fix
mount useSessionSync() (or a lighter "session appeared → reload" variant) at the App/router root so it also covers the unauthenticated routes.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** low · **Type:** bug · **Confidence:** high
**Location:** `src/app/hooks/useSessionSync.ts`, `src/app/pages/client/ClientRoot.tsx:212`
### Problem
`useSessionSync()` is mounted only inside `ClientRoot`, i.e. only in the authenticated shell.
A tab parked on the login/register/OIDC-callback pages never subscribes, so when another tab completes
a login that tab keeps showing the login form and, if the user submits it, starts a second
device/session for the same account. The symmetric case (logout in tab A while tab B is authenticated)
is handled correctly.
### How to trigger
open two tabs at the login screen, sign in on tab A, switch to tab B — it still shows the form.
### Suggested fix
mount `useSessionSync()` (or a lighter "session appeared → reload" variant) at the
`App`/router root so it also covers the unauthenticated routes.
---
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:25 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: bug · Confidence: high
Location:
src/app/hooks/useSessionSync.ts,src/app/pages/client/ClientRoot.tsx:212Problem
useSessionSync()is mounted only insideClientRoot, i.e. only in the authenticated shell.A tab parked on the login/register/OIDC-callback pages never subscribes, so when another tab completes
a login that tab keeps showing the login form and, if the user submits it, starts a second
device/session for the same account. The symmetric case (logout in tab A while tab B is authenticated)
is handled correctly.
How to trigger
open two tabs at the login screen, sign in on tab A, switch to tab B — it still shows the form.
Suggested fix
mount
useSessionSync()(or a lighter "session appeared → reload" variant) at theApp/router root so it also covers the unauthenticated routes.Filed from the September 2026 client audit (branch
lotus@4bea4895).