CVE-2026-101271 | | | 2026-09-29 | OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled. |
CVE-2026-102367 | Medium | 5.4 | 2026-09-29 | mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing… |
CVE-2026-88805 | High | 8.1 | 2026-09-28 | Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Ra… |
CVE-2026-100711 | High | 7.5 | 2026-09-26 | froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding h… |
CVE-2026-100624 | Medium | 5.4 | 2026-09-26 | Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request i… |
CVE-2026-100554 | Medium | 4.2 | 2026-09-26 | OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. N… |
CVE-2026-100502 | Medium | 5.0 | 2026-09-25 | Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain to… |
CVE-2026-67242 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validateto… |
CVE-2026-87720 | | | 2026-09-24 | Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code… |
CVE-2026-82566 | High | 8.8 | 2026-09-24 | The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client c… |
CVE-2026-75907 | High | 7.5 | 2026-09-24 | The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is… |
CVE-2026-97056 | Medium | 6.8 | 2026-09-24 | SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0… |
CVE-2026-73586 | Medium | 6.4 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged att… |
CVE-2026-92378 | | | 2026-09-23 | A session management
vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware
uniFLOW Online. Under specific timing conditions during Se… |
CVE-2026-86698 | | | 2026-09-22 | Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep r… |
CVE-2026-79313 | Critical | 9.8 | 2026-09-22 | webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead… |
CVE-2026-79317 | Medium | 4.8 | 2026-09-21 | A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user obj… |
CVE-2026-77519 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only… |
CVE-2026-86473 | Critical | 9.1 | 2026-09-21 | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as a… |
CVE-2026-92976 | | | 2026-09-18 | A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malic… |
CVE-2026-86533 | | | 2026-09-17 | Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenti… |
CVE-2026-81637 | | | 2026-09-17 | Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the call… |
CVE-2026-92920 | Medium | 5.4 | 2026-09-17 | admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permi… |
CVE-2026-92800 | Medium | 6.8 | 2026-09-16 | Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can re… |
CVE-2026-85387 | High | 7.1 | 2026-09-16 | Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been is… |
CVE-2026-92616 | Medium | 6.8 | 2026-09-16 | FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and wr… |
CVE-2026-82310 | High | 7.2 | 2026-09-16 | Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rej… |
CVE-2026-86462 | Critical | 9.1 | 2026-09-16 | Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed ses… |
CVE-2026-82311 | Critical | 9.8 | 2026-09-16 | Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it do… |
CVE-2026-92358 | Medium | 6.4 | 2026-09-16 | A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is cre… |
CVE-2026-55617 | | | 2026-09-15 | Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers… |
CVE-2026-88262 | | | 2026-09-15 | Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass.
This issue affects xClick: R2, R3, and R3.1. |
CVE-2026-81268 | High | 8.1 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session… |
CVE-2026-87014 | Medium | 6.5 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/route… |
CVE-2026-80174 | Medium | 5.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vuln… |
CVE-2026-55250 | | | 2026-09-08 | Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structur… |
CVE-2026-86215 | Medium | 4.3 | 2026-09-06 | A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the compo… |
CVE-2026-55513 | Medium | 5.4 | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ign… |
CVE-2026-61608 | Medium | 6.8 | 2026-09-04 | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users… |
CVE-2026-84480 | Critical | 9.8 | 2026-09-01 | WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account pas… |
CVE-2026-84203 | High | 8.1 | 2026-09-01 | Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attack… |
CVE-2026-82909 | Medium | 4.3 | 2026-08-31 | A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of… |
CVE-2026-82469 | Medium | 5.4 | 2026-08-29 | Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh to… |
CVE-2026-81826 | | | 2026-08-27 | Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.
This means that if an attacker already posses… |
CVE-2025-62342 | Medium | 6.4 | 2026-08-27 | HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions n… |
CVE-2026-73180 | Medium | 6.8 | 2026-08-25 | Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket con… |
CVE-2026-79664 | High | 7.4 | 2026-08-25 | Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after… |
CVE-2026-77130 | | | 2026-08-25 | The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with… |
CVE-2026-75554 | | | 2026-08-24 | Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its pr… |
CVE-2026-14950 | Critical | 9.8 | 2026-08-20 | An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increas… |
CVE-2026-65984 | | | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from c… |
CVE-2026-45791 | Medium | 5.9 | 2026-08-17 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts upda… |
CVE-2026-73611 | Medium | 6.8 | 2026-08-13 | File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attac… |
CVE-2026-66376 | Medium | 4.2 | 2026-08-12 | Credentials for a deleted user may remain valid for a short period under specific conditions. |
CVE-2026-17600 | High | 8.8 | 2026-08-07 | Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted… |
CVE-2026-48079 | High | 7.4 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to th… |
CVE-2025-12317 | Medium | 5.0 | 2026-08-06 | When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with… |
CVE-2025-12627 | Low | 2.4 | 2026-08-06 | The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who… |
CVE-2024-8995 | Medium | 4.9 | 2026-08-06 | Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these code… |
CVE-2026-60053 | Critical | 9.1 | 2026-08-05 | Insufficient Session Expiration vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Administrative API keys remained usable afte… |
CVE-2026-39924 | Medium | 6.8 | 2026-08-05 | Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access… |
CVE-2026-71206 | High | 8.3 | 2026-08-05 | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, neve… |
CVE-2026-14465 | Medium | 6.5 | 2026-08-04 | Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (a… |
CVE-2026-51953 | High | 7.4 | 2026-07-31 | An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components |
CVE-2026-14227 | Medium | 4.9 | 2026-07-30 | An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could… |
CVE-2024-40683 | Medium | 6.3 | 2026-07-30 | IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3… |
CVE-2026-16970 | Medium | 4.2 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be mi… |
CVE-2026-66400 | Medium | 4.8 | 2026-07-29 | Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to p… |
CVE-2026-14996 | High | 8.2 | 2026-07-28 | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management. |
CVE-2026-15967 | High | 7.5 | 2026-07-23 | Insufficient session expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3. |
CVE-2026-64829 | High | 7.4 | 2026-07-22 | Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authe… |
CVE-2026-56583 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse. |
CVE-2026-63753 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-tim… |
CVE-2026-16206 | Medium | 6.3 | 2026-07-19 | A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provid… |
CVE-2026-63089 | Critical | 9.3 | 2026-07-16 | WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthentica… |
CVE-2026-63175 | | | 2026-07-15 | PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, m… |
CVE-2026-61452 | Medium | 5.3 | 2026-07-15 | The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a… |
CVE-2026-56400 | High | 8.3 | 2026-07-15 | open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests t… |
CVE-2026-48329 | Low | 2.7 | 2026-07-14 | ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could lev… |
CVE-2026-44383 | High | 7.5 | 2026-07-10 | Multiple connections to the backend using the same charging station ID
are allowed, which could allow an attacker to deploy multiple instances
of malicious O… |
CVE-2026-56665 | Medium | 4.2 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 thr… |
CVE-2026-56664 | Medium | 4.2 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/provide… |
CVE-2026-28564 | Critical | 9.8 | 2026-07-10 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB.
REST Basic Authentication Accepts Stale Cached Credenti… |
CVE-2026-59219 | High | 7.1 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-j… |
CVE-2026-54779 | Medium | 5.9 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is… |
CVE-2026-49229 | High | 8.3 | 2026-07-07 | Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, w… |
CVE-2026-42172 | Low | 3.1 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire… |
CVE-2026-43918 | | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked in… |
CVE-2026-46455 | Critical | 9.8 | 2026-07-06 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component.
The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAcce… |
CVE-2026-14725 | Medium | 6.3 | 2026-07-05 | A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality. Such manipulat… |
CVE-2025-36359 | High | 8.1 | 2026-06-30 | IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate a… |
CVE-2026-54479 | High | 7.3 | 2026-06-25 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2025-71335 | High | 8.1 | 2026-06-25 | Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An at… |
CVE-2026-9705 | Medium | 6.5 | 2026-06-25 | A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit th… |
CVE-2026-52809 | Medium | 6.8 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation… |
CVE-2026-49277 | | | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rock… |
CVE-2026-45757 | | | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rock… |
CVE-2026-53928 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a password-forgot flow and could be used to mint… |
CVE-2026-53926 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called fr… |
CVE-2026-46554 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authenticate requests until their cache entry ex… |