Weakness (CWE)
CWE-1464: Improper Session Invalidation
The product establishes a session for an authenticated user, but it does not properly invalidate or terminate the session when it is required.
How to prevent it (1 mitigation)
-
Implementation
Ensure that user sessions are invalidated on the server-side for all possible security related events relevant to the application. It is important that the server-side handles all session invalidation and does not rely on the client to remove or delete a session, due to the possibility of adversaries capturing session identifiers or cookies for later reuse.
Source: MITRE CWE-1464
2 results · Clear filters · Feed
-
Low 2.3
Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they …
-
Low 2.7
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid