Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2026-34503HIGHOpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token RevocationEPSS 0.3%CVE-2026-88262HIGHInsufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick: R2, R3, and R3.1.EPSS 0.3%CVE-2026-81826CRITICALFlowintel Fails to Invalidate Active Sessions After Password ChangeEPSS 0.3%CVE-2025-36359HIGHIBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.EPSS 0.3%CVE-2025-64386HIGHHIJACKING OF THE TOKEN AND GAINING ACCESSEPSS 0.3%CVE-2026-27649MEDIUMCTEK Chargeportal Insufficient Session ExpirationEPSS 0.3%CVE-2024-35206HIGHA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application does not EPSS 0.3%CVE-2022-22371MEDIUMIBM Sterling B2B Integrator Standard Edition session fixationEPSS 0.3%CVE-2026-41133HIGHpyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)EPSS 0.3%CVE-2025-50486HIGHImproper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execEPSS 0.3%CVE-2026-61452MEDIUMGrav before 2.0.4 Improper Session Invalidation JWT Access TokensEPSS 0.3%CVE-2024-11627MEDIUM: Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 thrEPSS 0.3%CVE-2025-50485HIGHImproper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to exEPSS 0.3%CVE-2025-31952HIGHHCL iAutomate is affected by an insufficient session expirationEPSS 0.3%CVE-2026-25711MEDIUMChargemap chargemap.com Insufficient Session ExpirationEPSS 0.3%CVE-2026-92616HIGHFileRise < 3.28.0 Privilege Escalation via WebDAV Session InheritanceEPSS 0.3%CVE-2024-23586MEDIUMAn insufficient session timeout vulnerability affects HCL Nomad server on DominoEPSS 0.3%CVE-2026-3401LOWSourceCodester Web-based Pharmacy Product Management System session expirationEPSS 0.3%CVE-2021-31408MEDIUMServer session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19EPSS 0.3%CVE-2025-46336MEDIUMRack session gets restored after deletionEPSS 0.3%