Weakness (CWE)
CWE-613: DEPRECATED: Insufficient Session Expiration
This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.
Source: MITRE CWE-613
615 results · Feed
-
Medium 4.2
OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept a…
-
Medium 5.0
Flame through 2.4.0 Admin Token Insufficient Session Expiration
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-…
-
Medium 6.3
RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' an…
-
High 7.6
Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review
Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an au…
-
High 8.8
Botslab G980H Dashcams Insufficient session expiration
The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established …
-
High 7.5
CVE-2026-75907
The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to …
-
Medium 6.8
SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass
SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset tok…
-
Medium 6.4
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expira…
-
Medium 4.1
uniFLOW Online Legacy UI Previous login session retained when entering Reduced Function Login
A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which…
-
Low 2.3
Refresh tokens accepted as private repository credentials at the CDN
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh t…
-
Critical 9.8
webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on peri…
-
Medium 5.4
MaxKB: Expired application API keys remain usable on `/chat/api/mcp`
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the …
-
Critical 9.1
Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes n…
-
Medium 4.8
A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and au…
-
Medium 5.1
Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0
A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered …
-
Critical 9.1
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_authenticat…
-
Low 2.3
Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plu…
-
Medium 5.4
admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate…
-
Medium 6.8
Docs before 5.4.1 Stale Collaboration Session After Access Revocation
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never…
-
Low 2.0
Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access
Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not …
-
Medium 6.8
FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance
FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session isolation between the WebDAV interface and the web applica…
-
High 7.2
Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming …
-
Critical 9.1
Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that…
-
Critical 9.8
Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's …
-
Medium 6.4
Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking
A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established…
-
Medium 6.9
Hydro: Insufficient session expiration when recreating sessions
Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-sid…
-
High 8.7
Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick…
-
High 8.1
Langflow is vulnerable to authentication bypass and insufficient session expiration
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.
-
Medium 6.5
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without i…
-
Medium 5.3
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains…
-
High 8.7
Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational cac…
-
Medium 4.3
Mstfakts College-Management-System Logout server.php session expiration
A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the component Logout Handler. Such manipulation of the argument log_out leads to session expiration. It is po…
-
Medium 5.4
nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrol…
-
Medium 6.9
nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocat…
-
Medium 6.8
SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at…
-
Critical 9.8
WWBN AVideo Password Recovery Token Expiration Bypass
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the targ…
-
High 8.1
Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate …
-
Medium 4.3
QuantumNous new-api Revoked API Token token session expiration
A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. Th…
-
Medium 5.4
Rodauth before 2.47.0 Authentication Bypass via jwt_refresh
Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new…
-
Critical 9.1
Flowintel Fails to Invalidate Active Sessions After Password Change
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their…