Weaknesses of type CWE-613

477 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2026-40939MEDIUMDSF: Missing Session Timeout for OIDC SessionsEPSS 0.2%CVE-2026-66400MEDIUMGrav Login Plugin before 3.8.13 Insufficient Session ExpirationEPSS 0.2%CVE-2020-4914MEDIUMIBM Cloud Pak System Software Suite session fixationEPSS 0.1%CVE-2025-48061MEDIUMwire-webapp Has Insufficient Session Invalidation after User LogoutEPSS 0.1%CVE-2025-46741MEDIUMImproper Privilege ManagementEPSS 0.1%CVE-2026-44873MEDIUMInsufficient Session Invalidation on User Account Deactivation in AOS-8 Operating SystemEPSS 0.1%CVE-2026-24667MEDIUMOpen eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account AccessEPSS 0.1%CVE-2025-12627LOWImproper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized ActionsEPSS 0.1%CVE-2024-8995MEDIUMAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessEPSS 0.1%CVE-2025-55264MEDIUMHCL Aftermarket DPC is affected by Failure to Invalidate Session on Password ChangeEPSS 0.1%CVE-2025-15552MEDIUMLong Session Lifetime in Truesec LAPSWebUIEPSS 0.1%CVE-2025-15553MEDIUMInsecure Logout Functionality in Truesec LAPSWebUIEPSS 0.1%CVE-2025-54547MEDIUMOn affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expiredEPSS 0.1%CVE-2026-75907HIGHCVE-2026-75907EPSS —CVE-2026-73586MEDIUMDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. AEPSS —CVE-2026-97056HIGHSigNoz before 0.143.0 Insufficient Session Expiration Authentication BypassEPSS —CVE-2026-82566HIGHBotslab G980H Dashcams Insufficient session expirationEPSS —