Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2024-57056MEDIUMIncorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could bEPSS 0.3%CVE-2026-41891MEDIUMCI4MS: Deactivated User Session Bypass (active=0)EPSS 0.3%CVE-2026-35594MEDIUMVikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgradeEPSS 0.3%CVE-2026-56665MEDIUMZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP ProviderEPSS 0.3%CVE-2026-33417MEDIUMWallos: Password Reset Tokens Never ExpireEPSS 0.3%CVE-2026-6848MEDIUMQuay: red hat quay: authentication bypass allows privileged actions without valid credentialsEPSS 0.3%CVE-2025-50487HIGHImproper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows attEPSS 0.3%CVE-2025-50484HIGHImproper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hEPSS 0.3%CVE-2026-27933MEDIUMManyfold vulnerable to session hijack via cookie leakage in proxy cachesEPSS 0.3%CVE-2025-25019MEDIUMIBM QRadar Suite Software and IBM Cloud Pak for Security session fixationEPSS 0.3%CVE-2026-84203HIGHMemos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password ChangeEPSS 0.3%CVE-2025-59786MEDIUMCookies are not Invalidated upon Logout and Password ChangeEPSS 0.3%CVE-2025-1198MEDIUMInsufficient Session Expiration in GitLabEPSS 0.3%CVE-2026-20748MEDIUMEveron api.everon.io Insufficient Session ExpirationEPSS 0.3%CVE-2025-10223MEDIUMImproper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk)EPSS 0.3%CVE-2024-48926MEDIUMUmbraco CMS logout page displayed before session expirationEPSS 0.3%CVE-2026-32663MEDIUMIGL-Technologies eParking.fi Insufficient Session ExpirationEPSS 0.3%CVE-2024-22351MEDIUMIBM InfoSphere Information Server session fixationEPSS 0.2%CVE-2024-7998LOWIn affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespEPSS 0.2%CVE-2025-33005MEDIUMIBM Planning Analytics Local session fixationEPSS 0.2%