Weaknesses of type CWE-613

477 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2025-43819MEDIUMA Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4EPSS 0.2%CVE-2026-92378MEDIUMuniFLOW Online Legacy UI Previous login session retained when entering Reduced Function LoginEPSS 0.2%CVE-2025-12624MEDIUMImproper Token Invalidation in WSO2 Identity Server Allows Access After Account LockEPSS 0.2%CVE-2025-66483MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2025-4407MEDIUMApplication does not invalidate session after password resetEPSS 0.2%CVE-2024-41985LOWA vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=EPSS 0.2%CVE-2026-80174MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient SessEPSS 0.2%CVE-2025-36063MEDIUMMultiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.EPSS 0.2%CVE-2022-38707MEDIUMIBM Cognos Command Center information disclosureEPSS 0.2%CVE-2025-53642MEDIUMhaxcms-nodejs and haxcms-php Improperly Terminate SessionsEPSS 0.2%CVE-2025-65430MEDIUMAn issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user whEPSS 0.2%CVE-2022-34392MEDIUM SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An authenticated non-adminEPSS 0.2%CVE-2026-6515MEDIUMInsufficient Session Expiration in GitLabEPSS 0.2%CVE-2025-62781MEDIUMPILOS is missing session regeneration after password changeEPSS 0.2%CVE-2026-66376MEDIUMDeleted users may temporarily retain access to JFrog ArtifactoryEPSS 0.2%CVE-2025-27898MEDIUMMultiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsEPSS 0.2%CVE-2023-40732LOWA vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not inEPSS 0.2%CVE-2026-24669HIGHOpen eClass Insecure Password Reset Token Reuse Enables Account TakeoverEPSS 0.2%CVE-2026-16970MEDIUMDFIR-IRIS Insufficient Logout ImplementationEPSS 0.2%CVE-2024-40683MEDIUMIBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password changeEPSS 0.2%