Skip to content
OpenAdvisories

Weakness (CWE)

CWE-298: Improper Validation of Certificate Expiration

Variant Draft

A certificate expiration is not validated or is incorrectly validated.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Check for expired certificates and provide the user with adequate information about the nature of the problem and how to proceed.

  2. Implementation

    If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the expiration.

Source: MITRE CWE-298

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 4.8
    CVE-2024-1248

    Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation

    The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to ov…

    WSO2 WSO2 API Manager WSO2 Identity Server WSO2 Identity Server as Key Manager
  • Medium 5.5
    CVE-2025-59036

    Infrahub allows authentication with deleted and expired API tokens

    Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is a…

    opsmill infrahub infrahub-server PyPI
  • Medium 6.0
    CVE-2025-4384

    Certificate validity not properly verified

    The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the …

    arcinfo PcVue
  • Medium 6.5
    CVE-2023-42446

    Pow Mnesia cache doesn't invalidate all expired keys on startup

    Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated …

    pow-auth pow pow Hex
  • Medium 6.5
    CVE-2022-31145

    Insufficient AccessToken Expiration Check in FlyteAdmin

    FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after…

    flyteorg flyteadmin github.com/flyteorg/flyteadmin Go