CWE-613 · Insufficient Session Expiration (page 3)
Page 3 of 7 — CVEs classified under CWE-613, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68954 | Medium | 5.4 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a… |
CVE-2021-47740 | High | 7.5 | 2025-12-31 | KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. A… |
CVE-2022-50692 | High | 7.5 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session creden… |
CVE-2025-55254 | Low | 3.7 | 2025-12-17 | Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malic… |
CVE-2025-62329 | Medium | 5.0 | 2025-12-16 | HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused… |
CVE-2025-36360 | Medium | 5.0 | 2025-12-15 | IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8… |
CVE-2025-65430 | Medium | 5.4 | 2025-12-15 | An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was… |
CVE-2025-62631 | Medium | 5.6 | 2025-12-09 | An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS… |
CVE-2025-65883 | High | 8.4 | 2025-12-04 | A vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2–1.41) that allows a local network attacker to achieve Remote Code Execu… |
CVE-2025-11699 | High | 7.1 | 2025-12-01 | nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a va… |
CVE-2025-66289 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user… |
CVE-2025-66223 | | 2025-11-29 | OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even afte… | |
CVE-2025-53896 | High | 7.1 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a us… |
CVE-2025-64708 | Medium | 5.8 | 2025-11-19 | authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid rega… |
CVE-2025-63226 | Medium | 5.7 | 2025-11-18 | The Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is vulnerable to session hijacking due to improper session management on… |
CVE-2025-56643 | Critical | 9.1 | 2025-11-18 | Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and… |
CVE-2025-55278 | High | 8.1 | 2025-11-05 | Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their… |
CVE-2025-64386 | | 2025-10-31 | The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow… | |
CVE-2024-13996 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-exis… |
CVE-2025-54547 | Medium | 5.3 | 2025-10-29 | On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could per… |
CVE-2025-62781 | Medium | 5.0 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password whi… |
CVE-2025-12278 | Medium | 6.5 | 2025-10-26 | Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12110 | Medium | 5.4 | 2025-10-23 | A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted… |
CVE-2025-11429 | Medium | 5.4 | 2025-10-23 | A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions create… |
CVE-2025-3930 | | 2025-10-16 | Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen… | |
CVE-2025-25252 | Medium | 4.8 | 2025-10-14 | An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0… |
CVE-2024-33507 | High | 7.4 | 2025-10-14 | An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 through 2.4.4, 2.3 all… |
CVE-2025-62174 | Low | 3.5 | 2025-10-13 | Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user… |
CVE-2025-61775 | | 2025-10-13 | Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be r… | |
CVE-2023-49881 | Medium | 6.3 | 2025-10-01 | IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on t… |
CVE-2025-54592 | Critical | 9.8 | 2025-09-29 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the ses… |
CVE-2025-59841 | Critical | 9.8 | 2025-09-25 | Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation… |
CVE-2025-43819 | Medium | 6.5 | 2025-09-24 | A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 throu… |
CVE-2025-59335 | High | 7.1 | 2025-09-22 | CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. Th… |
CVE-2025-35433 | Medium | 5.0 | 2025-09-17 | CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log i… |
CVE-2025-10223 | Medium | 5.4 | 2025-09-10 | Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticat… |
CVE-2025-57766 | Medium | 4.8 | 2025-09-08 | Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions… |
CVE-2025-58437 | High | 8.1 | 2025-09-06 | Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be comp… |
CVE-2025-58352 | Medium | 6.5 | 2025-09-05 | Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verifica… |
CVE-2025-55162 | Medium | 6.3 | 2025-09-03 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1… |
CVE-2025-4643 | | 2025-08-29 | Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to fr… | |
CVE-2024-41985 | Low | 2.6 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2025-36040 | Medium | 6.5 | 2025-07-31 | IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side securit… |
CVE-2025-50486 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execute a session hijac… |
CVE-2025-50485 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hij… |
CVE-2025-50487 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows attackers to execute a… |
CVE-2025-50484 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack. |
CVE-2025-50491 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers to execute a session… |
CVE-2025-50488 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management System v3.0 allows attackers to execute a s… |
CVE-2025-31952 | High | 7.1 | 2025-07-24 | HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk… |
CVE-2024-27779 | Medium | 6.7 | 2025-07-18 | An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2… |
CVE-2025-53826 | Critical | 9.8 | 2025-07-15 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version… |
CVE-2025-53642 | Medium | 4.8 | 2025-07-11 | haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Ad… |
CVE-2025-4407 | Medium | 6.7 | 2025-06-30 | Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel Pro: through 1.0.1. |
CVE-2025-49152 | | 2025-06-25 | The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system. | |
CVE-2025-4754 | | 2025-06-17 | Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable after… | |
CVE-2024-50562 | Medium | 4.8 | 2025-06-10 | An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all version… |
CVE-2025-25019 | Medium | 4.8 | 2025-06-03 | IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which… |
CVE-2025-33005 | Medium | 6.3 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the… |
CVE-2025-48929 | Medium | 4.0 | 2025-05-28 | The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can… |
CVE-2025-48061 | Medium | 5.6 | 2025-05-22 | wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidate… |
CVE-2025-0138 | | 2025-05-14 | Web sessions in the web interface of Palo Alto Networks Prisma® Cloud Compute Edition do not expire when users are deleted, which makes Prisma Cloud Compute Ed… | |
CVE-2025-40566 | High | 8.8 | 2025-05-13 | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected produ… |
CVE-2025-46741 | Medium | 5.7 | 2025-05-12 | A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred. |
CVE-2025-4528 | Medium | 4.3 | 2025-05-11 | A weakness has been identified in Dígitro NGC Explorer up to 3.48.21. This affects an unknown function. Executing a manipulation can lead to session expiration… |
CVE-2025-46336 | Medium | 4.2 | 2025-05-08 | Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware… |
CVE-2025-32441 | Medium | 4.2 | 2025-05-07 | Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a… |
CVE-2025-46815 | High | 8.0 | 2025-05-06 | The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for… |
CVE-2025-46344 | | 2025-04-29 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke… | |
CVE-2025-2185 | High | 8.0 | 2025-04-25 | ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P) software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which … |
CVE-2021-47663 | High | 8.1 | 2025-04-24 | Due to improper JSON Web Tokens implementation an unauthenticated remote attacker can guess a valid session ID and therefore impersonate a user to gain full ac… |
CVE-2024-22351 | Medium | 6.3 | 2025-04-23 | IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the syst… |
CVE-2025-42602 | | 2025-04-23 | This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A rem… | |
CVE-2025-28059 | High | 7.5 | 2025-04-18 | An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalid… |
CVE-2024-45651 | Medium | 6.3 | 2025-04-18 | IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user… |
CVE-2024-49825 | Medium | 6.3 | 2025-04-14 | IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.20 and 23.0.0 through 23.0.20 does not invalidate session aft… |
CVE-2025-24859 | High | 8.8 | 2025-04-14 | A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes… |
CVE-2025-30516 | Low | 2.0 | 2025-04-14 | Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized use… |
CVE-2025-1968 | High | 7.7 | 2025-04-09 | Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session… |
CVE-2024-25051 | Medium | 6.6 | 2025-04-02 | IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another u… |
CVE-2025-28132 | Medium | 4.6 | 2025-04-01 | A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized… |
CVE-2025-2596 | Medium | 5.3 | 2025-03-26 | Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL) |
CVE-2024-57056 | Medium | 5.4 | 2025-02-18 | Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could be used by a malicio… |
CVE-2025-1198 | Medium | 4.2 | 2025-02-13 | An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived con… |
CVE-2025-24973 | Critical | 9.3 | 2025-02-11 | Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of… |
CVE-2025-24896 | High | 8.1 | 2025-02-11 | Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named `token` is… |
CVE-2024-45386 | High | 8.8 | 2025-02-11 | A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All vers… |
CVE-2024-13280 | Critical | 9.8 | 2025-01-09 | Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0… |
CVE-2024-45033 | High | 8.1 | 2025-01-08 | Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user passwor… |
CVE-2024-11627 | Medium | 6.8 | 2025-01-07 | : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, fro… |
CVE-2025-22386 | High | 7.3 | 2025-01-04 | An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting th… |
CVE-2024-56413 | Medium | 6.1 | 2025-01-02 | Missing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-56351 | Medium | 6.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles |
CVE-2024-55603 | Medium | 6.5 | 2024-12-19 | Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has e… |
CVE-2024-12667 | Low | 3.7 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices… |
CVE-2024-11668 | Medium | 4.2 | 2024-11-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connection… |
CVE-2024-35160 | Medium | 4.3 | 2024-11-23 | IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to… |
CVE-2024-11208 | Low | 3.7 | 2024-11-14 | A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The… |
CVE-2024-52553 | High | 8.8 | 2024-11-13 | Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login. |
CVE-2024-46892 | Medium | 4.9 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly invalidate sessions when the as… |