CWE-613 · Insufficient Session Expiration (page 2)
Page 2 of 6 — CVEs classified under CWE-613, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34503 | High | 8.1 | 2026-03-31 | OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can… |
CVE-2026-26060 | High | 8.8 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previously issued password r… |
CVE-2026-34362 | Medium | 5.4 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `verifyTokenSocket()` function in `plugin/YPTSocket/functions.php` has… |
CVE-2025-55264 | Medium | 5.5 | 2026-03-26 | HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control… |
CVE-2025-14810 | Medium | 6.3 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 does not invalidate a session after privileges have been modified which could allow an authenticate… |
CVE-2026-29092 | Medium | 4.9 | 2026-03-25 | Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked user… |
CVE-2026-33417 | Medium | 6.5 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_reset… |
CVE-2026-32663 | High | 7.3 | 2026-03-20 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2026-27649 | High | 7.3 | 2026-03-20 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2025-15553 | High | 7.1 | 2026-03-16 | Non-working logout functionality in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via dis… |
CVE-2025-15552 | High | 7.8 | 2026-03-16 | Insufficient Session Expiration in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disc… |
CVE-2026-32132 | High | 7.4 | 2026-03-11 | ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints… |
CVE-2026-30224 | Medium | 5.4 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user… |
CVE-2026-27764 | High | 7.3 | 2026-03-06 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2026-20748 | High | 7.3 | 2026-03-06 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2026-24912 | High | 7.3 | 2026-03-06 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2026-21622 | Critical | 9.8 | 2026-03-05 | Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset toke… |
CVE-2025-59786 | Critical | 9.8 | 2026-03-04 | 2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web appli… |
CVE-2026-28396 | Medium | 6.5 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not revoke existing refresh tokens, allowing a… |
CVE-2026-3401 | Low | 3.1 | 2026-03-02 | A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipulation causes sessi… |
CVE-2026-27647 | High | 7.3 | 2026-02-27 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identi… |
CVE-2026-26290 | High | 7.3 | 2026-02-27 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identi… |
CVE-2026-27652 | High | 7.3 | 2026-02-27 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identi… |
CVE-2026-25778 | High | 7.3 | 2026-02-27 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identi… |
CVE-2026-25711 | High | 7.3 | 2026-02-27 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identi… |
CVE-2026-20895 | High | 7.3 | 2026-02-27 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identi… |
CVE-2026-28275 | High | 8.1 | 2026-02-26 | Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens afte… |
CVE-2026-27968 | Medium | 4.3 | 2026-02-26 | Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareController::authorize() ver… |
CVE-2026-27933 | Medium | 6.8 | 2026-02-26 | Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Versions prior to 0.133.0… |
CVE-2026-27575 | Critical | 9.1 | 2026-02-25 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, passwor… |
CVE-2026-25476 | High | 7.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the session expiration check i… |
CVE-2026-26342 | Critical | 9.8 | 2026-02-24 | Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expirati… |
CVE-2026-1842 | | 2026-02-20 | HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued ac… | |
CVE-2026-1435 | Critical | 9.8 | 2026-02-18 | Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. T… |
CVE-2025-36377 | Medium | 6.3 | 2026-02-17 | IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an authenticated user to impersonate anot… |
CVE-2025-36376 | Medium | 6.3 | 2026-02-17 | IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an authenticated user to impersonate anot… |
CVE-2025-27898 | Medium | 6.3 | 2026-02-17 | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 does not invalidate session after a timeout which could allow an authenticated user to impersonate another… |
CVE-2026-24894 | High | 7.5 | 2026-02-12 | FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset be… |
CVE-2024-43181 | Medium | 6.3 | 2026-02-04 | IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. |
CVE-2026-24669 | High | 7.8 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an insecure password reset mechanism al… |
CVE-2026-24667 | Medium | 5.0 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessi… |
CVE-2026-24472 | Medium | 5.3 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclos… |
CVE-2025-55705 | High | 7.3 | 2026-01-22 | This vulnerability occurs when the system permits multiple simultaneous connections to the backend using the same charging station ID. This can result in una… |
CVE-2025-36065 | Medium | 6.3 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a browser closure which coul… |
CVE-2025-36063 | Medium | 6.3 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a logout which could allow a… |
CVE-2025-52661 | Low | 2.4 | 2026-01-19 | HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized… |
CVE-2025-4677 | Medium | 6.5 | 2026-01-07 | Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerV… |
CVE-2025-31962 | Low | 2.0 | 2026-01-07 | Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unautho… |
CVE-2025-68954 | Medium | 5.4 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a… |
CVE-2021-47740 | High | 7.5 | 2025-12-31 | KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. A… |
CVE-2022-50692 | High | 7.5 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session creden… |
CVE-2025-55254 | Low | 3.7 | 2025-12-17 | Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malic… |
CVE-2025-62329 | Medium | 5.0 | 2025-12-16 | HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused… |
CVE-2025-36360 | Medium | 5.0 | 2025-12-15 | IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8… |
CVE-2025-65430 | Medium | 5.4 | 2025-12-15 | An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was… |
CVE-2025-62631 | Medium | 5.6 | 2025-12-09 | An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS… |
CVE-2025-65883 | High | 8.4 | 2025-12-04 | A vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2–1.41) that allows a local network attacker to achieve Remote Code Execu… |
CVE-2025-11699 | High | 7.1 | 2025-12-01 | nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a va… |
CVE-2025-66289 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user… |
CVE-2025-66223 | | 2025-11-29 | OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even afte… | |
CVE-2025-53896 | High | 7.1 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a us… |
CVE-2025-64708 | Medium | 5.8 | 2025-11-19 | authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid rega… |
CVE-2025-63226 | Medium | 5.7 | 2025-11-18 | The Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is vulnerable to session hijacking due to improper session management on… |
CVE-2025-56643 | Critical | 9.1 | 2025-11-18 | Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and… |
CVE-2025-55278 | High | 8.1 | 2025-11-05 | Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their… |
CVE-2025-64386 | | 2025-10-31 | The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow… | |
CVE-2024-13996 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-exis… |
CVE-2025-54547 | Medium | 5.3 | 2025-10-29 | On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could per… |
CVE-2025-62781 | Medium | 5.0 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password whi… |
CVE-2025-12278 | Medium | 6.5 | 2025-10-26 | Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12110 | Medium | 5.4 | 2025-10-23 | A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted… |
CVE-2025-11429 | Medium | 5.4 | 2025-10-23 | A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions create… |
CVE-2025-3930 | | 2025-10-16 | Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen… | |
CVE-2025-25252 | Medium | 4.8 | 2025-10-14 | An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0… |
CVE-2024-33507 | High | 7.4 | 2025-10-14 | An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 through 2.4.4, 2.3 all… |
CVE-2025-62174 | Low | 3.5 | 2025-10-13 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user… |
CVE-2025-61775 | | 2025-10-13 | Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be r… | |
CVE-2023-49881 | Medium | 6.3 | 2025-10-01 | IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on t… |
CVE-2025-54592 | Critical | 9.8 | 2025-09-29 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the ses… |
CVE-2025-59841 | Critical | 9.8 | 2025-09-25 | Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation… |
CVE-2025-43819 | Medium | 6.5 | 2025-09-24 | A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 throu… |
CVE-2025-59335 | High | 7.1 | 2025-09-22 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. Th… |
CVE-2025-35433 | Medium | 5.0 | 2025-09-17 | CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log i… |
CVE-2025-10223 | Medium | 5.4 | 2025-09-10 | Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticat… |
CVE-2025-57766 | Medium | 4.8 | 2025-09-08 | Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions… |
CVE-2025-58437 | High | 8.1 | 2025-09-06 | Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be comp… |
CVE-2025-58352 | Medium | 6.5 | 2025-09-05 | Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verifica… |
CVE-2025-55162 | Medium | 6.3 | 2025-09-03 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1… |
CVE-2025-4643 | | 2025-08-29 | Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to fr… | |
CVE-2024-41985 | Low | 2.6 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2025-36040 | Medium | 6.5 | 2025-07-31 | IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side securit… |
CVE-2025-50486 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execute a session hijac… |
CVE-2025-50485 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hij… |
CVE-2025-50487 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows attackers to execute a… |
CVE-2025-50484 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack. |
CVE-2025-50491 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers to execute a session… |
CVE-2025-50488 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management System v3.0 allows attackers to execute a s… |
CVE-2025-31952 | High | 7.1 | 2025-07-24 | HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk… |
CVE-2024-27779 | Medium | 6.7 | 2025-07-18 | An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2… |
CVE-2025-53826 | Critical | 9.8 | 2025-07-15 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version… |