Weaknesses of type CWE-613

476 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2026-1163MEDIUMInsufficient Session Expiration in parisneo/lollmsEPSS 0.2%CVE-2023-32318HIGHUser session not correctly destroyed on logoutEPSS 0.2%CVE-2026-77130MEDIUMInsufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)EPSS 0.2%CVE-2026-53830MEDIUMOpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reloadEPSS 0.2%CVE-2026-86215MEDIUMMstfakts College-Management-System Logout server.php session expirationEPSS 0.2%CVE-2026-14465MEDIUMSession Fixation in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.2%CVE-2026-15967HIGHMOVEit Transfer refresh-token processing does not enforce updated account restrictionsEPSS 0.2%CVE-2025-62340LOWHCL iControl was affected by Inadequate Session Timeout vulnerabilityEPSS 0.2%CVE-2025-63226MEDIUMThe Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is vulnerable to session hijacking due to improper sesEPSS 0.2%CVE-2025-2596LOWSession logout can be overwritten by long lasting requestEPSS 0.2%CVE-2025-4677HIGHIdle session timeout is not configured for multiple open portsEPSS 0.2%CVE-2025-59335HIGHCubeCart Session Not Invalidated After Password ChangeEPSS 0.2%CVE-2026-52809MEDIUMGogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVESEPSS 0.2%CVE-2026-77519MEDIUMMaxKB: Expired application API keys remain usable on `/chat/api/mcp`EPSS 0.2%CVE-2026-1272LOWIBM Guardium Data Protection is affected by multiple vulnerabilitiesEPSS 0.2%CVE-2026-44511HIGHKatalyst Koi: Session cookies can be replayed after user logoutEPSS 0.2%CVE-2025-53896HIGHKiteworks MFT is vulnerable to Insufficient Session ExpirationEPSS 0.2%CVE-2025-36376MEDIUMIBM Security QRadar EDR Software has multiple vulnerabilitiesEPSS 0.2%CVE-2026-85387LOWConcrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API accessEPSS 0.2%CVE-2025-36377MEDIUMIBM Security QRadar EDR Software has multiple vulnerabilitiesEPSS 0.2%