Weakness (CWE)
CWE-324: Use of a Key Past its Expiration Date
The product uses a cryptographic key past its expiration date.
How to prevent it (2 mitigations)
-
Architecture and Design
Adequate consideration should be put into the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.
-
Implementation
Replace keys within a period of time proportional to their strength.
Source: MITRE CWE-324
27 results · Feed
-
Medium 4.2
Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every …
-
High 8.1
Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() me…
-
Low 3.1
sigstore-go fails to check signature timestamps against a signing key's validity period
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which …
-
Medium 6.8
Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation lifetime), not conf.Auth.ResetPasswordCodeLives. The token lifetime is baked into the token itself a…
-
High 8.1
OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution
OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket handlers fail to re-resolve authentication per-request, enabling attackers to use ro…
-
Medium 5.3
IBM Sterling Partner Engagement Manager Information Disclosure
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token
-
Medium 6.3
IBM Db2 improper account lockout
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date.
-
Medium 6.3
Virtual Secure Mode Spoofing Vulnerability
Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally.
-
Medium 4.1
Shim: expired secure boot certificate
The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded.
-
High 8.1
PgBouncer default auth_query does not take Postgres password expiry into account
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
-
High 8.7
Zitadel Expired JWT Keys Usable for Authorization Grants
Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allow…
-
Medium 4.8
Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity
A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seco…
-
Medium 4.8
Use of a Key Past its Expiration Date in Conduit
Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date
-
Medium 5.4
moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
-
Critical 9.8
keys: Fix overwrite of key expiration on instantiation
In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for…
-
Medium 4.3
IBM App Connect Enterprise information disclosure
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288175.
-
Medium 4.3
IBM App Connect Enterprise information disclosure
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288176.
-
Medium 4.3
IBM App Connect Enterprise information disclosure
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an expired access token. IBM X-Force ID: 288174.
-
Medium 6.5
In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PS…
-
Critical 9.0CVE-2022-35401 EPSS 21%
An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_496…
-
Unscored —
A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security pol…
-
High 8.2
Philips Vue PACS Use of a Key Past its Expiration Date
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
-
Medium 6.3
Maddy Mail Server does not implement account expiry
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually…
-
Medium 6.1
Ops Manager uaa client issues tokens after refresh token expiration
The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain a…
-
Critical 9.8
Contao Does Not Expire Tokens Correctly
Contao 4.7 allows Use of a Key Past its Expiration Date.
-
High 7.5
python-keystoneclient missing expiration check in PKI token validation
python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.
-
Medium 5.9
OpenStack Keystone Insufficient token expiration
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists …