Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2024-41827HIGHIn JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expirationEPSS 0.4%CVE-2023-20903MEDIUMThis disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity proEPSS 0.4%CVE-2026-12772MEDIUMBerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expirationEPSS 0.4%CVE-2022-23502MEDIUMTYPO3 contains Insufficient Session Expiration after Password ResetEPSS 0.4%CVE-2026-32132HIGHZITADEL: Reactivation of Expired Passkey Registration CodesEPSS 0.4%CVE-2025-4643MEDIUMLack of JWT Expiration after Log Out in PayloadCMSEPSS 0.4%CVE-2026-54321HIGHDaytona: Public sandbox previews remain accessible for up to one hour after being made privateEPSS 0.4%CVE-2026-86473CRITICALApache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiryEPSS 0.4%CVE-2025-4528MEDIUMDígitro NGC Explorer session expirationEPSS 0.4%CVE-2024-45462MEDIUMApache CloudStack: Incomplete session invalidation on web interface logoutEPSS 0.4%CVE-2026-44648HIGHSillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeoverEPSS 0.4%CVE-2026-21622CRITICALPassword Reset Tokens Do Not ExpireEPSS 0.4%CVE-2024-34092MEDIUMAn issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing sessioEPSS 0.4%CVE-2024-33507HIGHAn insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 thrEPSS 0.4%CVE-2026-48079HIGHOpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiryEPSS 0.4%CVE-2026-24912MEDIUMePower epower.ie Insufficient Session ExpirationEPSS 0.4%CVE-2025-28132MEDIUMA session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leadiEPSS 0.4%CVE-2021-20581MEDIUMIBM Security Verify Privilege information disclosureEPSS 0.4%CVE-2026-48726MEDIUMApache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout pathEPSS 0.4%CVE-2023-50936MEDIUMIBM PowerSC session fixationEPSS 0.4%