Skip to content
OpenAdvisories

Weakness (CWE)

CWE-613: DEPRECATED: Insufficient Session Expiration

Base Deprecated Mapping prohibited

This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.

Source: MITRE CWE-613

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.2
    CVE-2026-71206 Public exploit

    shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion

    Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists i…

    go-shiori shiori
  • High 7.5
    CVE-2026-44648 Public exploit

    SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

    SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, st…

    SillyTavern SillyTavern sillytavern npm
  • High 7.1
    CVE-2026-34828 Public exploit

    listmonk: Active sessions remain valid after password reset and password change

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes…

    knadh listmonk github.com/knadh/listmonk Go
  • High 8.8
    CVE-2024-48827 Public exploit

    An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via th…