Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2024-22389HIGHBIG-IP iControl REST API VulnerabilityEPSS 0.5%CVE-2024-45187HIGHMage AI allows deleted users to use the terminal server with admin access, leading to remote code executionEPSS 0.5%CVE-2022-3867LOWNomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage CollectedEPSS 0.5%CVE-2024-29402MEDIUMcskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity.EPSS 0.5%CVE-2025-49152HIGHInsufficient Session Expiration in MICROSENS NMP Web+EPSS 0.5%CVE-2022-24744LOWInsufficient Session Expiration in shopwareEPSS 0.5%CVE-2023-41041LOWUser session is still usable after logout in graylog2-server EPSS 0.5%CVE-2023-4005LOWInsufficient Session Expiration in fossbilling/fossbillingEPSS 0.5%CVE-2024-52311MEDIUMdata.all does not invalidate authentication token upon user logoutEPSS 0.5%CVE-2026-81637LOWReplayable OAuth2 CSRF state retained after a failed callback in AshAuthenticationEPSS 0.5%CVE-2024-0350LOWSourceCodester Engineers Online Portal session expirationEPSS 0.5%CVE-2026-24472MEDIUMHono cache middleware ignores "Cache-Control: private" leading to Web Cache DeceptionEPSS 0.5%CVE-2024-27779MEDIUMAn insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.EPSS 0.5%CVE-2026-63175HIGHCross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCaptureEPSS 0.5%CVE-2026-65984HIGHFUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessionsEPSS 0.5%CVE-2026-9705MEDIUMKeycloak: keycloak: attacker can re-enable and take over disabled clients via registration access tokenEPSS 0.5%CVE-2021-47663HIGHImproper session handlingEPSS 0.5%CVE-2023-40537HIGHMulti-blade VIPRION Configuration utility session cookie vulnerabilityEPSS 0.5%CVE-2022-48317MEDIUMInsecure Termination of RestAPI Session TokensEPSS 0.5%CVE-2026-59219HIGHOpen WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logoutEPSS 0.5%