cve.bz

CWE-613: Insufficient Session Expiration, page 3

Filter

deprecated by MITRE see CWE-1463, CWE-1464

This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.

What the weakness is: CWE-613 at MITRE

Ask an AI about CWE-613

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-613: Insufficient Session Expiration and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/613.html and https://cve.bz/cve/cwe/613?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2026-81826EPSS 0.4%

    Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the…

  2. 6.4CVE-2025-62342EPSS 0.3%

    HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion.

  3. 6.8CVE-2026-73180EPSS 0.4%

    Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokce…

  4. 9.1CVE-2026-79664EPSS 0.4%

    Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil …

  5. 5.3CVE-2026-77130EPSS 0.4%

    The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control o…

  6. 2.3CVE-2026-75554EPSS 0.4%

    Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expand_repositories_scope/3 in lib/hexpm/permissions.ex only re…

  7. 9.2CVE-2026-14950EPSS 0.6%

    An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and m…

  8. 7.5CVE-2026-65984EPSS 0.5%

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups…

  9. 5.9CVE-2026-45791EPSS 0.4%

    Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compro…

  10. 7.6CVE-2026-73611EPSS 0.4%

    File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrativ…

  11. 5.4CVE-2026-66376EPSS 0.2%

    Credentials for a deleted user may remain valid for a short period under specific conditions.

  12. 8.7CVE-2026-17600EPSS 0.4%

    Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already log…

  13. 7.4CVE-2026-48079EPSS 0.5%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the `/logout` page, the page's server-side load handler deletes the `access_token`…

  14. 5.0CVE-2025-12317EPSS 0.3%

    When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous acces…

  15. 2.4CVE-2025-12627EPSS 0.2%

    The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh to…

  16. 4.9CVE-2024-8995EPSS 0.2%

    Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the au…

  17. 9.1CVE-2026-60053EPSS 0.6%

    Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspe…

  18. 7.6CVE-2026-39924EPSS 0.4%

    Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never…

  19. 8.3CVE-2026-71206EPSS 0.4%

    Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocatio…

  20. 6.5CVE-2026-14465EPSS 0.4%

    Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (aka Session Replay). This issue affects HUMANIST Digital Human Resources: from 2…

  21. 7.4CVE-2026-51953EPSS 0.4%

    An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components

  22. 6.9CVE-2026-14227EPSS 0.4%

    An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity …

  23. 6.3CVE-2024-40683EPSS 0.3%

    IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow …

  24. 4.2CVE-2026-16970EPSS 0.2%

    The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.

  25. 6.3CVE-2026-66400EPSS 0.2%

    Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remembe…

  26. 8.2CVE-2026-14996EPSS 0.3%

    IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.

  27. 9.8CVE-2026-15967EPSS 0.4%

    Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

  28. 9.1CVE-2026-64829EPSS 0.4%

    Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear …

  29. 3.1CVE-2026-56583EPSS 0.2%

    HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse.

  30. 5.3CVE-2026-63753EPSS 0.4%

    SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connectio…

  31. 5.3CVE-2026-16206EPSS 0.4%

    A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attac…

  32. 9.0CVE-2026-63089EPSS 0.4%

    WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a k…

  33. 7.1CVE-2026-63175EPSS 0.5%

    PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state…

  34. 6.9CVE-2026-61452EPSS 0.2%

    The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh …

  35. 9.0CVE-2026-56400EPSS 0.5%

    open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the op…

  36. 2.7CVE-2026-48329EPSS 0.6%

    ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write…

  37. 8.7CVE-2026-44383EPSS 0.6%

    Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.

  38. 4.2CVE-2026-56665EPSS 0.3%

    ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 through 3.4.11 and from 4.0.0-rc.1 through 4.15.1, ZITADEL's external JWT Identity …

  39. 4.2CVE-2026-56664EPSS 0.3%

    ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips the maximum token age freshness check when an incoming t…

  40. 9.8CVE-2026-28564EPSS 0.7%

    Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are reco…

  41. 7.1CVE-2026-59219EPSS 0.6%

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authenti…

  42. 5.9CVE-2026-54779EPSS 0.4%

    CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not reject duplicate to…

  43. 8.3CVE-2026-49229EPSS 0.3%

    Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shar…

  44. 3.1CVE-2026-42172EPSS 0.2%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked token to retain access indefinitely until manually revoked. T…

  45. 8.7CVE-2026-43918EPSS 0.4%

    FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked inactive, existing authenticated sessions are not invalidated. The session identit…

  46. 9.8CVE-2026-46455EPSS 0.7%

    Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subj…

  47. 2.1CVE-2026-14725EPSS 0.4%

    A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality. Such manipulation leads to session expiration. It is possible to launch the attack remotely. T…

  48. 6.5CVE-2025-36359EPSS 0.3%

    IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.

  49. 6.9CVE-2026-54479EPSS 0.4%

    The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnera…

  50. 8.6CVE-2025-71335EPSS 0.4%

    Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session tok…