CVE-2026-96806 | | | 2026-10-15 | The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issu… |
CVE-2026-57493 | Medium | 6.8 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in re… |
CVE-2026-89073 | High | 7.5 | 2026-10-14 | Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0… |
CVE-2026-107371 | Medium | 5.4 | 2026-10-13 | When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the… |
CVE-2026-74037 | High | 7.2 | 2026-10-13 | Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attacker… |
CVE-2026-84321 | Medium | 5.4 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value… |
CVE-2026-109362 | Medium | 5.4 | 2026-10-12 | Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing sco… |
CVE-2026-109320 | Medium | 5.4 | 2026-10-12 | The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, bec… |
CVE-2026-109289 | Medium | 6.3 | 2026-10-12 | Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through… |
CVE-2026-78357 | Critical | 9.1 | 2026-10-12 | Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. … |
CVE-2026-108809 | Low | 3.5 | 2026-10-12 | A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/prot… |
CVE-2026-108803 | Medium | 6.3 | 2026-10-12 | A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the compone… |
CVE-2026-108785 | Medium | 6.3 | 2026-10-12 | A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the comp… |
CVE-2026-104084 | High | 8.8 | 2026-10-09 | SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not reva… |
CVE-2026-71575 | Critical | 9.1 | 2026-10-09 | The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted compariso… |
CVE-2026-107721 | Medium | 5.9 | 2026-10-08 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option vali… |
CVE-2026-107719 | Medium | 4.2 | 2026-10-08 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed… |
CVE-2026-107275 | Medium | 6.8 | 2026-10-08 | @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that th… |
CVE-2024-8122 | Medium | 5.9 | 2026-10-08 | The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused… |
CVE-2026-46437 | Medium | 4.8 | 2026-10-07 | wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bea… |
CVE-2026-83540 | High | 8.8 | 2026-10-07 | When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not… |
CVE-2026-105690 | Medium | 5.9 | 2026-10-05 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding ser… |
CVE-2026-97212 | High | 7.3 | 2026-10-02 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2026-104468 | Medium | 4.8 | 2026-10-02 | YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expi… |
CVE-2026-66253 | Low | 3.1 | 2026-10-01 | iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthori… |
CVE-2026-103283 | High | 8.1 | 2026-10-01 | Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only… |
CVE-2026-103279 | Medium | 6.8 | 2026-10-01 | Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain acc… |
CVE-2026-101271 | | | 2026-09-29 | OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled. |
CVE-2026-102367 | Medium | 5.4 | 2026-09-29 | mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing… |
CVE-2026-88805 | High | 8.1 | 2026-09-28 | Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Ra… |
CVE-2026-100711 | High | 7.5 | 2026-09-26 | froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding h… |
CVE-2026-100624 | Medium | 5.4 | 2026-09-26 | Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request i… |
CVE-2026-100554 | Medium | 4.2 | 2026-09-26 | OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. N… |
CVE-2026-100502 | Medium | 5.0 | 2026-09-25 | Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain to… |
CVE-2026-67242 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validateto… |
CVE-2026-87720 | | | 2026-09-24 | Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code… |
CVE-2026-82566 | High | 8.8 | 2026-09-24 | The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client c… |
CVE-2026-75907 | High | 7.5 | 2026-09-24 | The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is… |
CVE-2026-97056 | Medium | 6.8 | 2026-09-24 | SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0… |
CVE-2026-73586 | Medium | 6.4 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged att… |
CVE-2026-92378 | | | 2026-09-23 | A session management
vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware
uniFLOW Online. Under specific timing conditions during Se… |
CVE-2026-86698 | | | 2026-09-22 | Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep r… |
CVE-2026-79313 | Critical | 9.8 | 2026-09-22 | webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead… |
CVE-2026-79317 | Medium | 4.8 | 2026-09-21 | A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user obj… |
CVE-2026-77519 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only… |
CVE-2026-86473 | Critical | 9.1 | 2026-09-21 | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as a… |
CVE-2026-92976 | | | 2026-09-18 | A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malic… |
CVE-2026-86533 | | | 2026-09-17 | Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenti… |
CVE-2026-81637 | | | 2026-09-17 | Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the call… |
CVE-2026-92920 | Medium | 5.4 | 2026-09-17 | admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permi… |
CVE-2026-92800 | Medium | 6.8 | 2026-09-16 | Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can re… |
CVE-2026-85387 | High | 7.1 | 2026-09-16 | Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been is… |
CVE-2026-92616 | Medium | 6.8 | 2026-09-16 | FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and wr… |
CVE-2026-82310 | High | 7.2 | 2026-09-16 | Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rej… |
CVE-2026-86462 | Critical | 9.1 | 2026-09-16 | Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed ses… |
CVE-2026-82311 | Critical | 9.8 | 2026-09-16 | Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it do… |
CVE-2026-92358 | Medium | 6.4 | 2026-09-16 | A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is cre… |
CVE-2026-55617 | | | 2026-09-15 | Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers… |
CVE-2026-88262 | | | 2026-09-15 | Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass.
This issue affects xClick: R2, R3, and R3.1. |
CVE-2026-81268 | High | 8.1 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session… |
CVE-2026-87014 | Medium | 6.5 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/route… |
CVE-2026-80174 | Medium | 5.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vuln… |
CVE-2026-55250 | | | 2026-09-08 | Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structur… |
CVE-2026-86215 | Medium | 4.3 | 2026-09-06 | A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the compo… |
CVE-2026-55513 | Medium | 5.4 | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ign… |
CVE-2026-61608 | Medium | 6.8 | 2026-09-04 | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users… |
CVE-2026-84480 | Critical | 9.8 | 2026-09-01 | WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account pas… |
CVE-2026-84203 | High | 8.1 | 2026-09-01 | Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attack… |
CVE-2026-82909 | Medium | 4.3 | 2026-08-31 | A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of… |
CVE-2026-82469 | Medium | 5.4 | 2026-08-29 | Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh to… |
CVE-2026-81826 | | | 2026-08-27 | Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.
This means that if an attacker already posses… |
CVE-2025-62342 | Medium | 6.4 | 2026-08-27 | HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions n… |
CVE-2026-73180 | Medium | 6.8 | 2026-08-25 | Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket con… |
CVE-2026-79664 | High | 7.4 | 2026-08-25 | Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after… |
CVE-2026-77130 | | | 2026-08-25 | The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with… |
CVE-2026-75554 | | | 2026-08-24 | Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its pr… |
CVE-2026-14950 | Critical | 9.8 | 2026-08-20 | An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increas… |
CVE-2026-65984 | | | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from c… |
CVE-2026-45791 | Medium | 5.9 | 2026-08-17 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts upda… |
CVE-2026-73611 | Medium | 6.8 | 2026-08-13 | File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attac… |
CVE-2026-66376 | Medium | 4.2 | 2026-08-12 | Credentials for a deleted user may remain valid for a short period under specific conditions. |
CVE-2026-17600 | High | 8.8 | 2026-08-07 | Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted… |
CVE-2026-48079 | High | 7.4 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to th… |
CVE-2025-12317 | Medium | 5.0 | 2026-08-06 | When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with… |
CVE-2025-12627 | Low | 2.4 | 2026-08-06 | The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who… |
CVE-2024-8995 | Medium | 4.9 | 2026-08-06 | Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these code… |
CVE-2026-60053 | Critical | 9.1 | 2026-08-05 | Insufficient Session Expiration vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Administrative API keys remained usable afte… |
CVE-2026-39924 | Medium | 6.8 | 2026-08-05 | Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access… |
CVE-2026-71206 | High | 8.3 | 2026-08-05 | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, neve… |
CVE-2026-14465 | Medium | 6.5 | 2026-08-04 | Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (a… |
CVE-2026-51953 | High | 7.4 | 2026-07-31 | An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components |
CVE-2026-14227 | Medium | 4.9 | 2026-07-30 | An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could… |
CVE-2024-40683 | Medium | 6.3 | 2026-07-30 | IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3… |
CVE-2026-16970 | Medium | 4.2 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be mi… |
CVE-2026-66400 | Medium | 4.8 | 2026-07-29 | Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to p… |
CVE-2026-14996 | High | 8.2 | 2026-07-28 | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management. |
CVE-2026-15967 | High | 7.5 | 2026-07-23 | Insufficient session expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3. |
CVE-2026-64829 | High | 7.4 | 2026-07-22 | Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authe… |
CVE-2026-56583 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse. |
CVE-2026-63753 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-tim… |