Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2026-34362MEDIUMAVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()EPSS 0.2%CVE-2025-64708MEDIUMauthentik invitation expiry is delayed by at least 5 minutesEPSS 0.2%CVE-2026-43983HIGHPocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictionsEPSS 0.2%CVE-2026-41902CRITICALFreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaksEPSS 0.2%CVE-2026-17600HIGHNexus Repository 3 - Session Not Invalidated on User Account Deletion or DeactivationEPSS 0.2%CVE-2026-75554LOWExplicit organization scopes survive token refresh after membership endsEPSS 0.2%CVE-2025-68954HIGHPterodactyl does not revoke SFTP access when server is deleted or permissions reducedEPSS 0.2%CVE-2026-92800HIGHDocs before 5.4.1 Stale Collaboration Session After Access RevocationEPSS 0.2%CVE-2026-40587MEDIUMblueprintUE: Active Sessions Are Not Invalidated After Password Change or ResetEPSS 0.2%CVE-2025-14810MEDIUMIBM InfoSphere Information Server is vulnerable due to insufficient session expirationEPSS 0.2%CVE-2025-12317MEDIUMImproper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access PrivilegesEPSS 0.2%CVE-2023-45659LOWSession is not expiring after password reset in EngelsystemEPSS 0.2%CVE-2026-35462MEDIUMPapra Does Not Reject Expired API KeysEPSS 0.2%CVE-2024-43181MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.2%CVE-2026-29092MEDIUMKiteworks Email Protection Gateway has an Insufficient Session ExpirationEPSS 0.2%CVE-2026-61608MEDIUMSolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation linksEPSS 0.2%CVE-2025-11429MEDIUMKeycloak-server: too long and not settings compliant sessionEPSS 0.2%CVE-2026-82469MEDIUMRodauth before 2.47.0 Authentication Bypass via jwt_refreshEPSS 0.2%CVE-2024-56413MEDIUMMissing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169EPSS 0.2%CVE-2025-32441MEDIUMRack session gets restored after deletionEPSS 0.2%