CWE-613 · Insufficient Session Expiration

588 CVEs classified under CWE-613 (Insufficient Session Expiration). Browse by severity and year.

Top CVEs for CWE-613
CVESeverityScorePublishedSummary
CVE-2024-8888Critical10.02024-09-18An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have…
CVE-2026-28564Critical9.82026-07-10Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credenti…
CVE-2026-46455Critical9.82026-07-06Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAcce…
CVE-2026-21622Critical9.82026-03-05Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset toke…
CVE-2025-59786Critical9.82026-03-042N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web appli…
CVE-2026-26342Critical9.82026-02-24Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expirati…
CVE-2026-1435Critical9.82026-02-18Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. T…
CVE-2024-13996Critical9.82025-10-30Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-exis…
CVE-2025-54592Critical9.82025-09-29FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the ses…
CVE-2025-59841Critical9.82025-09-25Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation…
CVE-2025-53826Critical9.82025-07-15File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version…
CVE-2024-13280Critical9.82025-01-09Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0…
CVE-2024-43685Critical9.82024-10-04Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 be…
CVE-2024-42447Critical9.82024-08-05Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache A…
CVE-2024-29401Critical9.82024-03-26xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.
CVE-2024-25718Critical9.82024-02-11In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Sam…
CVE-2023-5865Critical9.82023-10-31Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
CVE-2023-5838Critical9.82023-10-29Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9.
CVE-2023-4005Critical9.82023-07-31Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5.
CVE-2023-35857Critical9.82023-06-19In Siren Investigate before 13.2.2, session keys remain active even after logging out.
All CVEs classified under CWE-613 — newest first (page 1 of 6)
CVESeverityScorePublishedSummary
CVE-2026-73611Medium6.82026-08-13File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attac…
CVE-2026-66376Medium4.22026-08-12Credentials for a deleted user may remain valid for a short period under specific conditions.
CVE-2026-176002026-08-07Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted…
CVE-2026-48079High7.42026-08-06OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to th…
CVE-2025-12317Medium5.02026-08-06When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with…
CVE-2025-12627Low2.42026-08-06The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who…
CVE-2024-8995Medium4.92026-08-06Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these code…
CVE-2026-60053Critical9.12026-08-05Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable afte…
CVE-2026-39924Medium6.82026-08-05Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access…
CVE-2026-71206High8.32026-08-05Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, neve…
CVE-2026-14465Medium6.52026-08-04Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (a…
CVE-2026-51953High7.42026-07-31An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components
CVE-2026-14227Medium4.92026-07-30An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could…
CVE-2024-40683Medium6.32026-07-30IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3…
CVE-2026-16970Medium4.22026-07-30The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be mi…
CVE-2026-66400Medium4.82026-07-29Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to p…
CVE-2026-14996High8.22026-07-28IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
CVE-2026-15967High7.52026-07-23Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
CVE-2026-64829High7.42026-07-22Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authe…
CVE-2026-56583Low3.12026-07-21HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse.
CVE-2026-63753Medium4.32026-07-20SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-tim…
CVE-2026-16206Medium6.32026-07-19A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provid…
CVE-2026-63089Critical9.32026-07-16WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthentica…
CVE-2026-631752026-07-15PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, m…
CVE-2026-61452Medium5.32026-07-15The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a…
CVE-2026-56400High8.32026-07-15open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests t…
CVE-2026-48329Low2.72026-07-14ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could lev…
CVE-2026-44383High7.52026-07-10Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious O…
CVE-2026-56665Medium4.22026-07-10ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 thr…
CVE-2026-56664Medium4.22026-07-10ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/provide…
CVE-2026-28564Critical9.82026-07-10Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credenti…
CVE-2026-59219High7.12026-07-09Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-j…
CVE-2026-54779Medium5.92026-07-08CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is…
CVE-2026-49229High8.32026-07-07Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, w…
CVE-2026-42172Low3.12026-07-07Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire…
CVE-2026-439182026-07-06FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked in…
CVE-2026-46455Critical9.82026-07-06Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAcce…
CVE-2026-14725Medium6.32026-07-05A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality. Such manipulat…
CVE-2025-36359High8.12026-06-30IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate a…
CVE-2026-54479High7.32026-06-25The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi…
CVE-2025-71335High8.12026-06-25Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An at…
CVE-2026-9705Medium6.52026-06-25A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit th…
CVE-2026-52809Medium6.82026-06-24Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation…
CVE-2026-492772026-06-24Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rock…
CVE-2026-457572026-06-24Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rock…
CVE-2026-539282026-06-23NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a password-forgot flow and could be used to mint…
CVE-2026-539262026-06-23NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called fr…
CVE-2026-465542026-06-23NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authenticate requests until their cache entry ex…
CVE-2026-54321High7.02026-06-23Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that w…
CVE-2026-55423Medium6.12026-06-23Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user…
CVE-2026-9162Medium4.32026-06-22Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSock…
CVE-2026-12796Medium6.32026-06-21A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/managemen…
CVE-2026-12772Medium6.32026-06-21A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py…
CVE-2025-62340Low3.12026-06-17HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automaticall…
CVE-2026-53843High8.82026-06-16OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority…
CVE-2026-53776Critical9.12026-06-16Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting o…
CVE-2026-44188Medium5.32026-06-15A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access…
CVE-2026-53830Medium6.52026-06-12OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active a…
CVE-2026-53824Medium6.52026-06-12OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor re…
CVE-2026-46657High7.12026-06-08Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain…
CVE-2026-46656High8.82026-06-08Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the correspondi…
CVE-2026-464012026-06-05HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper session termination vulnerability where a…
CVE-2026-48726Medium6.52026-06-01A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `Fa…
CVE-2026-44648High7.52026-05-29SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-…
CVE-2026-9802Medium6.82026-05-28A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mech…
CVE-2026-8670Critical9.62026-05-22Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay). This issue aff…
CVE-2026-1815Medium5.72026-05-21Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking. This issue…
CVE-2026-44553High8.12026-05-15Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, administrative role changes and user deletio…
CVE-2026-22706Medium6.52026-05-14Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the…
CVE-2026-44511High7.42026-05-14Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user lo…
CVE-2026-5545Medium6.52026-05-13libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both…
CVE-2026-44873Medium5.42026-05-12A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled…
CVE-2026-43983High8.12026-05-12Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function…
CVE-2026-43911Medium6.82026-05-11Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by…
CVE-2026-41902Critical9.12026-05-07FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-chara…
CVE-2026-41519Medium4.22026-05-07Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_se…
CVE-2026-418912026-05-07CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26…
CVE-2026-40934Medium6.82026-05-05Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a st…
CVE-2026-42421Medium5.42026-04-28OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can mai…
CVE-2026-41916Medium5.42026-04-28OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. New…
CVE-2026-25720Medium5.42026-04-24A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain a…
CVE-2026-41356Medium5.42026-04-23OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maint…
CVE-2026-1272Low2.72026-04-23IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user access control panel.
CVE-2026-6515Medium5.42026-04-22GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have a…
CVE-2026-6848Medium5.42026-04-22A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creat…
CVE-2026-41133High8.82026-04-22pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `role` and `permission` in the session at…
CVE-2026-409392026-04-21The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessio…
CVE-2026-40587Medium6.52026-04-21blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via the profile edit page, or when a password reset…
CVE-2026-0971Medium4.32026-04-21An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login…
CVE-2025-12624Medium6.02026-04-16Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previo…
CVE-2026-34454Low3.52026-04-14OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the…
CVE-2026-35594Medium6.52026-04-10Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_…
CVE-2025-57735Critical9.12026-04-09When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. I…
CVE-2026-1163Medium4.12026-04-08An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a p…
CVE-2026-5376Medium5.92026-04-07An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved. This is an instance of CWE-613: Insu…
CVE-2026-35462Medium4.32026-04-07Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current ti…
CVE-2026-34828High7.12026-04-02listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allo…
CVE-2025-66483Medium6.32026-04-01IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user o…
CVE-2026-34572High8.82026-04-01CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version…
CVE-2026-34570High8.82026-04-01CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version…