Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2026-73180MEDIUMApache Tomcat: Authenticated WebSocket session survives end of HTTP sessionEPSS 0.5%CVE-2023-42768HIGHBIG-IP iControl REST vulnerabilityEPSS 0.5%CVE-2025-54592HIGHFreshRSS has Incomplete Session Termination on LogoutEPSS 0.5%CVE-2024-12667MEDIUMInvoicePlane view session expirationEPSS 0.5%CVE-2024-0260MEDIUMSourceCodester Engineers Online Portal Password Change change_password_teacher.php session expirationEPSS 0.5%CVE-2026-56400CRITICALopen-webui - Remote Code Execution via CORS Misconfiguration and Session ValidationEPSS 0.5%CVE-2023-40174MEDIUMInsufficient Session Expiration in fobybus/social-media-skeletonEPSS 0.5%CVE-2025-3930MEDIUMLack of JWT Expiration after Log Out in StrapiEPSS 0.5%CVE-2023-51772HIGHOne Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on theEPSS 0.5%CVE-2024-21722MEDIUM[20240201] - Core - Insufficient session expiration in MFA management viewsEPSS 0.5%CVE-2023-28001MEDIUMAn insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or cEPSS 0.5%CVE-2023-5838MEDIUMInsufficient Session Expiration in linkstackorg/linkstackEPSS 0.5%CVE-2024-0008MEDIUMPAN-OS: Insufficient Session Expiration Vulnerability in the Web InterfaceEPSS 0.5%CVE-2024-55603MEDIUMInsufficient session invalidation in KanboardEPSS 0.5%CVE-2026-34570HIGHCI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)EPSS 0.5%CVE-2025-53826HIGHFileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after LogoutEPSS 0.5%CVE-2026-34572HIGHCI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)EPSS 0.5%CVE-2025-4754LOWMissing Session Revocation on Logout in ash_authentication_phoenixEPSS 0.5%CVE-2024-31447MEDIUMShopware has Improper Session Handling in store-apiEPSS 0.5%CVE-2024-30262MEDIUMContao's remember-me tokens will not be cleared after a password changeEPSS 0.5%