Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2023-45187MEDIUMIBM Engineering Lifecycle Optimization - Publishing session fixationEPSS 0.4%CVE-2025-71335HIGHFlowise - Session Invalidation Failure After Password ChangeEPSS 0.4%CVE-2023-47628MEDIUMSession Expiration Misconfiguration in datahubEPSS 0.4%CVE-2024-25628HIGHInsufficient Session Expiration in alf.ioEPSS 0.4%CVE-2022-32759MEDIUMIBM Security Directory Server information disclosureEPSS 0.4%CVE-2025-65883HIGHA vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2–1.41) that allows a local network attacker to achievEPSS 0.4%CVE-2026-1435CRITICALIncorrect management of session invalidation vulnerability in Graylog Web InterfaceEPSS 0.4%CVE-2025-58437HIGHCoder's privilege escalation vulnerability could lead to a cross workspace compromiseEPSS 0.4%CVE-2023-45600MEDIUMA CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, fEPSS 0.4%CVE-2023-25562MEDIUMFailure to Invalidate Session on Logout in DataHubEPSS 0.4%CVE-2024-5995HIGHSoar Cloud HR Portal - Insufficient Session ExpirationEPSS 0.4%CVE-2026-24894HIGHFrankenPHP leaks session data between requests in worker modeEPSS 0.4%CVE-2024-25051MEDIUMIBM Jazz Reporting Service insufficient session expirationEPSS 0.4%CVE-2026-28275HIGHInitiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)EPSS 0.4%CVE-2026-14725MEDIUMSourceCodester Online Boat Reservation System session expirationEPSS 0.4%CVE-2026-16206MEDIUMdjango-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expirationEPSS 0.4%CVE-2026-43918HIGHSuspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flowsEPSS 0.4%CVE-2024-25619LOWDestroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodonEPSS 0.4%CVE-2021-3844MEDIUMRapid7 InsightVM Insufficient Session ExpirationEPSS 0.4%CVE-2025-56643CRITICALRequarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokenEPSS 0.4%