Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2026-27575CRITICALVijkunja has Weak Password Policy Combined with Persistent Sessions After Password ChangeEPSS 0.4%CVE-2026-86698LOWRefresh tokens accepted as private repository credentials at the CDNEPSS 0.4%CVE-2025-11699HIGHCVE-2025-11699EPSS 0.4%CVE-2025-59841CRITICALFlagForgeCTF's Improper Session Handling Allows Access After LogoutEPSS 0.4%CVE-2021-46279MEDIUMSession Fixation and Insufficient Session ExpirationEPSS 0.4%CVE-2024-8888CRITICALInsufficient Session Expiration vulnerability on CIRCUTOR Q-SMTEPSS 0.4%CVE-2026-54479MEDIUMEVoke Systems EVoke CSMS Insufficient Session ExpirationEPSS 0.4%CVE-2026-64829CRITICALQuestion2Answer 1.8.8 Session Fixation via Forgot-Password FlowEPSS 0.4%CVE-2025-42602HIGHImproper Authentication Vulnerability in Meon KYC solutionsEPSS 0.4%CVE-2024-35048MEDIUMAn issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password.EPSS 0.4%CVE-2022-39234MEDIUMuser session persists even after permanently deleting account in GLPIEPSS 0.4%CVE-2026-63089CRITICALWireGuard Easy Weak Token Generation Information Disclosure via OTL RouteEPSS 0.4%CVE-2025-46344MEDIUMAuth0 NextJS SDK v4 Missing Session InvalidationEPSS 0.4%CVE-2024-22358MEDIUMIBM UrbanCode Deploy session fixationEPSS 0.4%CVE-2021-35473CRITICALAn issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verifEPSS 0.4%CVE-2022-24732MEDIUMMaddy Mail Server does not implement account expiryEPSS 0.4%CVE-2024-13280CRITICALPersistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044EPSS 0.4%CVE-2026-45791MEDIUMDokploy: Password Change Does Not Revoke Active SessionsEPSS 0.4%CVE-2024-4680LOWInsufficient Session Expiration in zenml-io/zenmlEPSS 0.4%CVE-2026-53926MEDIUMNocoDB: OAuth Tokens Persist Through Security EventsEPSS 0.4%