Weaknesses of type CWE-613

477 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2025-62329MEDIUMHCL DevOps Deploy / HCL Launch is susceptible to an insufficient session expiration vulnerabilityEPSS 0.2%CVE-2025-36360MEDIUMIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Insufficient Session Expiration vulnerabilityEPSS 0.2%CVE-2025-62342MEDIUMHCL IntelliOps Event Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2025-24973CRITICALConcorde not removing authentication tokens after logging outEPSS 0.2%CVE-2026-42421LOWOpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token RotationEPSS 0.2%CVE-2026-55513MEDIUMnebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensEPSS 0.2%CVE-2026-41356LOWOpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotateEPSS 0.2%CVE-2025-55278HIGHHCL DevOps Loop is susceptible to an improper authentication vulnerabilityEPSS 0.2%CVE-2026-27968MEDIUMPackistry accepts expired access tokensEPSS 0.2%CVE-2025-31962LOWHCL BigFix IVR is impacted by an insufficient session expiration vulnerabilityEPSS 0.2%CVE-2021-27751MEDIUMHCL Commerce is affected by an Insufficient Session Expiration vulnerability.EPSS 0.2%CVE-2026-92920MEDIUMadmin3 through 3.0.0 Session Not Invalidated When a User Account Is DisabledEPSS 0.2%CVE-2025-36065MEDIUMMultiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.EPSS 0.2%CVE-2026-34454LOWOAuth2 Proxy: Session cookie not cleared when rendering sign-in pageEPSS 0.2%CVE-2026-53824MEDIUMMattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh DelayEPSS 0.2%CVE-2026-28396MEDIUMNocoDB: Refresh Tokens Not Revoked on Password ResetEPSS 0.2%CVE-2026-0971MEDIUMGoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeoutEPSS 0.2%CVE-2025-52661LOWHCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resultiEPSS 0.2%CVE-2024-1623HIGHInsufficient session timeout vulnerability in Sagemcom routerEPSS 0.2%CVE-2026-1815MEDIUMSession Hijacking in TEİAŞ's Mobile ApplicationEPSS 0.2%