List of steps to reproduce (step by step, including full links if applicable):
- Maciej, a Foundation contractor with two accounts (in this case, the staff account MNadzikiewicz (WMF) and the volunteer account Nadzik accesses SecurePoll with his staff account.
- Maciej does not vote, instead logs out and logs back in with their second account Nadzik to vote with that
- User "jumps" to SecurePoll a second time and votes with the Nadzik account
What happens?:
- SecurePoll erroneously reports on the "vote details" page that MNadzikiewicz (WMF) and Nadzik voted with the same cookies (and this, Nadzik's vote is a duplicate): https://vote.wikimedia.org/wiki/Special:SecurePoll/details/43485
What should have happened instead?:
- Because MNadzikiewicz (WMF) did not vote (as can be seen publicly on the voter list for the Universal Code of Conduct Enforcement Guidelines Ratification vote, this account should not appear in the Cookie duplicate users space.
A similar case happened with Brazal.dang and IBrazal (WMF) (the latter account did not appear to vote): https://vote.wikimedia.org/wiki/Special:SecurePoll/details/42759