Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2024-31999HIGH@fastify/secure-session: Reuse of destroyed secure session cookieEPSS 0.6%CVE-2023-4190MEDIUMInsufficient Session Expiration in admidio/admidioEPSS 0.6%CVE-2025-24896HIGHMisskey allows token to remain valid in cookie after signing outEPSS 0.6%CVE-2023-22492MEDIUMRefreshToken invalidation vulnerabilityEPSS 0.6%CVE-2026-14950CRITICALFrauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logicEPSS 0.6%CVE-2024-0943LOWTotolink N350RT cstecgi.cgi session expirationEPSS 0.6%CVE-2024-25954MEDIUMDell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated EPSS 0.6%CVE-2020-6292MEDIUMLogout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient SessionEPSS 0.6%CVE-2023-5865HIGHInsufficient Session Expiration in thorsten/phpmyfaqEPSS 0.6%CVE-2023-40025MEDIUMArgo CD web terminal session doesn't expireEPSS 0.6%CVE-2022-50692MEDIUMSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration VulnerabilityEPSS 0.6%CVE-2023-23929HIGHRefresh tokens do not expire in Vantage6EPSS 0.6%CVE-2026-12796MEDIUMBerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expirationEPSS 0.6%CVE-2023-4126MEDIUMInsufficient Session Expiration in answerdev/answerEPSS 0.6%CVE-2026-48329LOWColdFusion | Insufficient Session Expiration (CWE-613)EPSS 0.6%CVE-2022-2782CRITICALIn affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the sessionEPSS 0.6%CVE-2026-44383HIGHHydro-Québec Le Circuit Electrique charging station backend Insufficient Session ExpirationEPSS 0.6%CVE-2026-79313CRITICALwebpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expirEPSS 0.6%CVE-2024-45386HIGHA vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCSEPSS 0.6%CVE-2026-55250HIGHMaravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged CachesEPSS 0.6%