Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2026-53776CRITICALPerry < 0.5.1166 JWT Expiration Bypass via verify_decodeEPSS 0.4%CVE-2024-35160MEDIUMIBM Watson Query on Cloud Pak for Data and IBM Db2 Big SQL on Cloud Pak for Data information disclosureEPSS 0.4%CVE-2026-20895MEDIUMEV2GO ev2go.io Insufficient Session ExpirationEPSS 0.4%CVE-2023-45718LOWHCL Sametime is impacted by a failure to invalidate sessionsEPSS 0.4%CVE-2023-40695MEDIUMIBM Cognos Controller session fixationEPSS 0.4%CVE-2026-63753MEDIUMSurrealDB before 3.1.0 Authentication Bypass via LIVE QueryEPSS 0.4%CVE-2025-0138LOWPrisma Cloud Compute Edition: Insufficient Session Expiration Vulnerability in the Web InterfaceEPSS 0.4%CVE-2026-60053CRITICALApache Answer: Residual Administrative API Key Access After Role or Account RevocationEPSS 0.3%CVE-2025-55162MEDIUMEnvoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flagEPSS 0.3%CVE-2025-61775MEDIUMVickey's unexpired email confirmation link can be reused to send repeated confirmation emailsEPSS 0.3%CVE-2025-55705HIGHEVMAPA Insufficient Session ExpirationEPSS 0.3%CVE-2024-36523MEDIUMAn access control issue in Wvp GB28181 Pro 2.0 allows users to continue to access information in the application after deleting their own orEPSS 0.3%CVE-2025-25252MEDIUMAn Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10EPSS 0.3%CVE-2026-73611HIGHFile Browser 2.50.0 through 2.63.21 JWT Expiration BypassEPSS 0.3%CVE-2022-40228LOWIBM DataPower Gateway session fixationEPSS 0.3%CVE-2019-5647MEDIUMRapid7 AppSpider Chrome Plugin Insufficient Session ExpirationEPSS 0.3%CVE-2019-14826MEDIUMA flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this EPSS 0.3%CVE-2026-26290MEDIUMEV Energy ev.energy Insufficient Session ExpirationEPSS 0.3%CVE-2026-26060MEDIUMFleet: Password reset tokens remain valid after password change for 24 hoursEPSS 0.3%CVE-2026-9162MEDIUMGlobal session revocation does not invalidate active WebSocket connectionsEPSS 0.3%