Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2022-38382MEDIUMIBM Cloud Pak for Security session fixationEPSS 0.3%CVE-2025-62631MEDIUMAn insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 alEPSS 0.3%CVE-2026-34828HIGHlistmonk: Active sessions remain valid after password reset and password changeEPSS 0.3%CVE-2026-9802MEDIUMKeycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restartEPSS 0.3%CVE-2025-12110MEDIUMKeycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removedEPSS 0.3%CVE-2026-42172LOWCoolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent AccessEPSS 0.3%CVE-2024-56351MEDIUMIn JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user rolesEPSS 0.3%CVE-2022-2888MEDIUMInsufficient Session Expiration in octoprint/octoprintEPSS 0.3%CVE-2025-57766LOWFides's Admin UI User Password Change Does Not Invalidate Current SessionEPSS 0.3%CVE-2021-3461—A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity providerEPSS 0.3%CVE-2024-46892MEDIUMA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly invalidate sEPSS 0.3%CVE-2024-36041HIGHKSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on EPSS 0.3%CVE-2026-27764MEDIUMMobiliti e-mobi.hu Insufficient Session ExpirationEPSS 0.3%CVE-2019-3867—A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access tEPSS 0.3%CVE-2026-46656HIGHBludit CMS has improper authorization and mediation failure leading to persistent ghost sessionsEPSS 0.3%CVE-2024-32006MEDIUMA vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application does not expire the EPSS 0.3%CVE-2026-84480CRITICALWWBN AVideo Password Recovery Token Expiration BypassEPSS 0.3%CVE-2025-50491HIGHImproper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers tEPSS 0.3%CVE-2026-87014MEDIUMOpen WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notesEPSS 0.3%CVE-2026-44188MEDIUMAnsible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expirationEPSS 0.3%