cve.bz

CWE-613: Insufficient Session Expiration, page 7

Filter

deprecated by MITRE see CWE-1463, CWE-1464

This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.

What the weakness is: CWE-613 at MITRE

Ask an AI about CWE-613

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-613: Insufficient Session Expiration and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/613.html and https://cve.bz/cve/cwe/613?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2025-50486EPSS 0.4%

    Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execute a session hijacking attack.

  2. 7.1CVE-2025-50485EPSS 0.4%

    Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hijacking attack.

  3. 7.1CVE-2025-50487EPSS 0.3%

    Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows attackers to execute a session hijacking attack.

  4. 7.1CVE-2025-50484EPSS 0.3%

    Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack.

  5. 7.1CVE-2025-50491EPSS 0.3%

    Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers to execute a session hijacking attack.

  6. 7.1CVE-2025-50488EPSS 0.4%

    Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management System v3.0 allows attackers to execute a session hijacking attack.

  7. 7.1CVE-2025-31952EPSS 0.4%

    HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access.

  8. 6.7CVE-2024-27779EPSS 0.6%

    An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all…

  9. 7.7CVE-2025-53826EPSS 0.6%

    File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that r…

  10. 6.5CVE-2025-53642EPSS 0.2%

    haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulner…

  11. 6.8CVE-2025-4407EPSS 0.2%

    Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel Pro: through 1.0.1.

  12. 8.7CVE-2025-49152EPSS 0.5%

    The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system.

  13. 2.3CVE-2025-4754EPSS 0.5%

    Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects…

  14. 4.8CVE-2024-50562ExploitEPSS 1.2%

    An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log …

  15. 6.5CVE-2025-25019EPSS 0.3%

    IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system.

  16. 8.8CVE-2025-33005EPSS 0.3%

    IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

  17. 9.8CVE-2025-48929EPSS 0.3%

    The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary.

  18. 5.6CVE-2025-48061EPSS 0.1%

    wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logg…

  19. 2.0CVE-2025-0138EPSS 0.4%

    Web sessions in the web interface of Palo Alto Networks Prisma® Cloud Compute Edition do not expire when users are deleted, which makes Prisma Cloud Compute Edition susceptible to unauthorized access. Compute in Prisma Cloud Enterprise Ed…

  20. 8.7CVE-2025-40566EPSS 0.5%

    A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected products do not correctly invalidate user sessions upon user logout. This could allow…

  21. 5.7CVE-2025-46741EPSS 0.1%

    A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.

  22. 2.1CVE-2025-4528EPSS 0.4%

    A weakness has been identified in Dígitro NGC Explorer up to 3.48.21. This affects an unknown function. Executing a manipulation can lead to session expiration. The attack can be launched remotely. Upgrading to version 3.48.22 mitigates th…

  23. 4.2CVE-2025-46336EPSS 0.4%

    Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), …

  24. 4.2CVE-2025-32441EPSS 0.3%

    Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that sess…

  25. 8.0CVE-2025-46815EPSS 0.5%

    The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the cli…

  26. 4.9CVE-2025-46344EPSS 0.4%

    The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, …

  27. 8.5CVE-2025-2185EPSS 0.3%

    ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P) software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which could permit an attacker to transmit passwords over unencrypted connections, re…

  28. 8.1CVE-2021-47663EPSS 0.5%

    Due to improper JSON Web Tokens implementation an unauthenticated remote attacker can guess a valid session ID and therefore impersonate a user to gain full access.

  29. 6.3CVE-2024-22351EPSS 0.3%

    IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

  30. 8.2CVE-2025-42602EPSS 0.4%

    This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A remote attacker could exploit this vulnerability by intercepting and manipulating t…

  31. 7.5CVE-2025-28059EPSS 0.8%

    An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. When an administrator deletes a user account, th…

  32. 6.5CVE-2024-45651EPSS 0.3%

    IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.

  33. 4.3CVE-2024-49825EPSS 0.2%

    IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session after a logout which could allow an authenticated user to impersonate another user …

  34. 2.1CVE-2025-24859EPSS 1.1%

    A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an admin…

  35. 7.5CVE-2025-30516EPSS 0.3%

    Mattermost Mobile Apps versions <=2.25.0  fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized users on shared devices to access sensitive notification content via continued mobi…

  36. 7.7CVE-2025-1968EPSS 0.3%

    Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 1…

  37. 7.2CVE-2024-25051EPSS 0.4%

    IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system.

  38. 4.6CVE-2025-28132EPSS 0.4%

    A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized access and account takeover. This occurs due to insufficient session expiration,…

  39. 2.3CVE-2025-2596EPSS 0.2%

    Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL)

  40. 5.4CVE-2024-57056EPSS 0.3%

    Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could be used by a malicious attacker to impersonate an existing user session.

  41. 5.3CVE-2025-1198EPSS 0.3%

    An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens acces…

  42. 9.3CVE-2025-24973EPSS 0.2%

    Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a us…

  43. 8.1CVE-2025-24896EPSS 0.6%

    Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named `token` is stored in a cookie for authentication purposes in Bull Dashboard, but this remai…

  44. 8.7CVE-2024-45386EPSS 0.6%

    A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Saf…

  45. 9.8CVE-2024-13280EPSS 0.4%

    Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.

  46. 8.1CVE-2024-45033EPSS 1.0%

    Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been clea…

  47. 8.1CVE-2024-11627EPSS 0.3%

    : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 …

  48. 7.3CVE-2025-22386EPSS 0.3%

    An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tie…

  49. 6.1CVE-2024-56413EPSS 0.2%

    Missing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.

  50. 8.8CVE-2024-56351EPSS 0.3%

    In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles