CVE-2026-73611 | Medium | 6.8 | 2026-08-13 | File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attac… |
CVE-2026-66376 | Medium | 4.2 | 2026-08-12 | Credentials for a deleted user may remain valid for a short period under specific conditions. |
CVE-2026-17600 | | | 2026-08-07 | Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted… |
CVE-2026-48079 | High | 7.4 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to th… |
CVE-2025-12317 | Medium | 5.0 | 2026-08-06 | When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with… |
CVE-2025-12627 | Low | 2.4 | 2026-08-06 | The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who… |
CVE-2024-8995 | Medium | 4.9 | 2026-08-06 | Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these code… |
CVE-2026-60053 | Critical | 9.1 | 2026-08-05 | Insufficient Session Expiration vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Administrative API keys remained usable afte… |
CVE-2026-39924 | Medium | 6.8 | 2026-08-05 | Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access… |
CVE-2026-71206 | High | 8.3 | 2026-08-05 | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, neve… |
CVE-2026-14465 | Medium | 6.5 | 2026-08-04 | Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (a… |
CVE-2026-51953 | High | 7.4 | 2026-07-31 | An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components |
CVE-2026-14227 | Medium | 4.9 | 2026-07-30 | An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could… |
CVE-2024-40683 | Medium | 6.3 | 2026-07-30 | IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3… |
CVE-2026-16970 | Medium | 4.2 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be mi… |
CVE-2026-66400 | Medium | 4.8 | 2026-07-29 | Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to p… |
CVE-2026-14996 | High | 8.2 | 2026-07-28 | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management. |
CVE-2026-15967 | High | 7.5 | 2026-07-23 | Insufficient session expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3. |
CVE-2026-64829 | High | 7.4 | 2026-07-22 | Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authe… |
CVE-2026-56583 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse. |
CVE-2026-63753 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-tim… |
CVE-2026-16206 | Medium | 6.3 | 2026-07-19 | A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provid… |
CVE-2026-63089 | Critical | 9.3 | 2026-07-16 | WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthentica… |
CVE-2026-63175 | | | 2026-07-15 | PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, m… |
CVE-2026-61452 | Medium | 5.3 | 2026-07-15 | The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a… |
CVE-2026-56400 | High | 8.3 | 2026-07-15 | open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests t… |
CVE-2026-48329 | Low | 2.7 | 2026-07-14 | ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could lev… |
CVE-2026-44383 | High | 7.5 | 2026-07-10 | Multiple connections to the backend using the same charging station ID
are allowed, which could allow an attacker to deploy multiple instances
of malicious O… |
CVE-2026-56665 | Medium | 4.2 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 thr… |
CVE-2026-56664 | Medium | 4.2 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/provide… |
CVE-2026-28564 | Critical | 9.8 | 2026-07-10 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB.
REST Basic Authentication Accepts Stale Cached Credenti… |
CVE-2026-59219 | High | 7.1 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-j… |
CVE-2026-54779 | Medium | 5.9 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is… |
CVE-2026-49229 | High | 8.3 | 2026-07-07 | Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, w… |
CVE-2026-42172 | Low | 3.1 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire… |
CVE-2026-43918 | | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked in… |
CVE-2026-46455 | Critical | 9.8 | 2026-07-06 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component.
The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAcce… |
CVE-2026-14725 | Medium | 6.3 | 2026-07-05 | A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality. Such manipulat… |
CVE-2025-36359 | High | 8.1 | 2026-06-30 | IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate a… |
CVE-2026-54479 | High | 7.3 | 2026-06-25 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2025-71335 | High | 8.1 | 2026-06-25 | Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An at… |
CVE-2026-9705 | Medium | 6.5 | 2026-06-25 | A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit th… |
CVE-2026-52809 | Medium | 6.8 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation… |
CVE-2026-49277 | | | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rock… |
CVE-2026-45757 | | | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rock… |
CVE-2026-53928 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a password-forgot flow and could be used to mint… |
CVE-2026-53926 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called fr… |
CVE-2026-46554 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authenticate requests until their cache entry ex… |
CVE-2026-54321 | High | 7.0 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that w… |
CVE-2026-55423 | Medium | 6.1 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user… |
CVE-2026-9162 | Medium | 4.3 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSock… |
CVE-2026-12796 | Medium | 6.3 | 2026-06-21 | A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/managemen… |
CVE-2026-12772 | Medium | 6.3 | 2026-06-21 | A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py… |
CVE-2025-62340 | Low | 3.1 | 2026-06-17 | HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automaticall… |
CVE-2026-53843 | High | 8.8 | 2026-06-16 | OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority… |
CVE-2026-53776 | Critical | 9.1 | 2026-06-16 | Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting o… |
CVE-2026-44188 | Medium | 5.3 | 2026-06-15 | A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access… |
CVE-2026-53830 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active a… |
CVE-2026-53824 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor re… |
CVE-2026-46657 | High | 7.1 | 2026-06-08 | Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain… |
CVE-2026-46656 | High | 8.8 | 2026-06-08 | Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the correspondi… |
CVE-2026-46401 | | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper session termination vulnerability where a… |
CVE-2026-48726 | Medium | 6.5 | 2026-06-01 | A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `Fa… |
CVE-2026-44648 | High | 7.5 | 2026-05-29 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-9802 | Medium | 6.8 | 2026-05-28 | A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mech… |
CVE-2026-8670 | Critical | 9.6 | 2026-05-22 | Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay).
This issue aff… |
CVE-2026-1815 | Medium | 5.7 | 2026-05-21 | Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking.
This issue… |
CVE-2026-44553 | High | 8.1 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, administrative role changes and user deletio… |
CVE-2026-22706 | Medium | 6.5 | 2026-05-14 | Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the… |
CVE-2026-44511 | High | 7.4 | 2026-05-14 | Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user lo… |
CVE-2026-5545 | Medium | 6.5 | 2026-05-13 | libcurl might in some circumstances reuse the wrong connection when asked to
do an authenticated HTTP(S) request after a Negotiate-authenticated one, when
both… |
CVE-2026-44873 | Medium | 5.4 | 2026-05-12 | A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled… |
CVE-2026-43983 | High | 8.1 | 2026-05-12 | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function… |
CVE-2026-43911 | Medium | 6.8 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by… |
CVE-2026-41902 | Critical | 9.1 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-chara… |
CVE-2026-41519 | Medium | 4.2 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_se… |
CVE-2026-41891 | | | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26… |
CVE-2026-40934 | Medium | 6.8 | 2026-05-05 | Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a st… |
CVE-2026-42421 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can mai… |
CVE-2026-41916 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. New… |
CVE-2026-25720 | Medium | 5.4 | 2026-04-24 | A vulnerability exists in SenseLive
X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain a… |
CVE-2026-41356 | Medium | 5.4 | 2026-04-23 | OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maint… |
CVE-2026-1272 | Low | 2.7 | 2026-04-23 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user access control panel. |
CVE-2026-6515 | Medium | 5.4 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have a… |
CVE-2026-6848 | Medium | 5.4 | 2026-04-22 | A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creat… |
CVE-2026-41133 | High | 8.8 | 2026-04-22 | pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `role` and `permission` in the session at… |
CVE-2026-40939 | | | 2026-04-21 | The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessio… |
CVE-2026-40587 | Medium | 6.5 | 2026-04-21 | blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via the profile edit page, or when a password reset… |
CVE-2026-0971 | Medium | 4.3 | 2026-04-21 | An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login… |
CVE-2025-12624 | Medium | 6.0 | 2026-04-16 | Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previo… |
CVE-2026-34454 | Low | 3.5 | 2026-04-14 | OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the… |
CVE-2026-35594 | Medium | 6.5 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_… |
CVE-2025-57735 | Critical | 9.1 | 2026-04-09 | When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. I… |
CVE-2026-1163 | Medium | 4.1 | 2026-04-08 | An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a p… |
CVE-2026-5376 | Medium | 5.9 | 2026-04-07 | An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved. This is an instance of CWE-613: Insu… |
CVE-2026-35462 | Medium | 4.3 | 2026-04-07 | Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current ti… |
CVE-2026-34828 | High | 7.1 | 2026-04-02 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allo… |
CVE-2025-66483 | Medium | 6.3 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user o… |
CVE-2026-34572 | High | 8.8 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |
CVE-2026-34570 | High | 8.8 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version… |