Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2025-28059HIGHAn access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improEPSS 0.8%CVE-2023-38489HIGHKirby vulnerable to Insufficient Session Expiration after a password changeEPSS 0.8%CVE-2021-25940HIGHArangoDB - Insufficient Session Expiration after Password ChangeEPSS 0.8%CVE-2026-86462CRITICALApache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionsEPSS 0.8%CVE-2021-41247LOWincomplete logout in JupyterHubEPSS 0.8%CVE-2022-21652LOWInsufficient Session Expiration in shopwareEPSS 0.8%CVE-2024-29070CRITICALApache StreamPark: session not invalidated after logoutEPSS 0.8%CVE-2024-29401CRITICALxzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.EPSS 0.8%CVE-2021-25985HIGHFactorJS - Insufficient Session Expiration Leads to a Local Account TakeoverEPSS 0.8%CVE-2023-1543MEDIUMInsufficient Session Expiration in answerdev/answerEPSS 0.8%CVE-2023-49091HIGHJwttoken in Cosmos server never expires after password changed and logging outEPSS 0.8%CVE-2020-15218MEDIUMAdmin pages are cached and can be embeddedEPSS 0.8%CVE-2024-11208MEDIUMApereo CAS login session expirationEPSS 0.8%CVE-2020-1768MEDIUMExternal Interface does not invalidate sessionEPSS 0.7%CVE-2022-37186MEDIUMIn LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting.EPSS 0.7%CVE-2024-35049CRITICALSurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590.EPSS 0.7%CVE-2023-22732LOWInsufficient Session Expiration in Administration in shopwareEPSS 0.7%CVE-2026-26342HIGHTattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token ExpirationEPSS 0.7%CVE-2024-27782HIGHMultiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stoEPSS 0.7%CVE-2023-37570HIGHInsufficient Session Expiration Vulnerability in Emagic Data Center Management SuiteEPSS 0.7%