Weaknesses of type CWE-613

475 results

Expiração de Sessão Inadequada

Aplicação não invalida ou renova sessões no tempo adequado, permitindo que tokens ou cookies expirados continuem funcionando ou que sessões ativas permaneçam indefinidamente. Isso facilita ataques de fixação de sessão, roubo de token e acesso não autorizado mesmo após logout.

Example

Um portal bancário não remove a sessão do servidor quando o usuário faz logout; se um atacante conseguir o cookie de sessão antigo, consegue reativar acesso à conta. Ou uma API que emite JWT sem data de expiração, permitindo que qualquer token roubado funcione para sempre.

How to mitigate

Implemente expiração de sessão obrigatória (timeout absoluto e inatividade), invalide tokens no servidor ao logout, use cookies com flags Secure, HttpOnly e SameSite, e defina tempos realistas (não eternos). Em APIs com JWT, sempre inclua exp (expiration) e implemente refresh tokens com ciclo de vida curto.

CVE-2023-46158MEDIUMIBM WebSphere Application Server session fixationEPSS 0.5%CVE-2023-0041MEDIUMIBM Security Guardium session fixationEPSS 0.5%CVE-2024-22403LOWOAuth2 authorization codes are valid indefinetly in Nextcloud serverEPSS 0.5%CVE-2024-34709MEDIUMDirectus Lacks Session Tokens InvalidationEPSS 0.4%CVE-2022-40230MEDIUM"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to iEPSS 0.4%CVE-2024-35220HIGH@fastify/session reuses destroyed session cookieEPSS 0.4%CVE-2025-46815HIGHZITADEL Allows IdP Intent Token ReuseEPSS 0.4%CVE-2022-45862LOWAn insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; ForEPSS 0.4%CVE-2022-47406MEDIUMAn issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPOEPSS 0.4%CVE-2026-49229HIGHActual: Disabled OpenID users keep access through existing session tokensEPSS 0.4%CVE-2024-31995MEDIUMzcap has incomplete expiration checks in capability chains.EPSS 0.4%CVE-2023-5889MEDIUMInsufficient Session Expiration in pkp/pkp-libEPSS 0.4%CVE-2024-43685HIGHSession token fixation in TimeProvider 4100EPSS 0.4%CVE-2025-40566HIGHA vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 UpdateEPSS 0.4%CVE-2024-39809HIGHBIG-IP Next Central Manager vulnerabilityEPSS 0.4%CVE-2023-1788MEDIUMInsufficient Session Expiration in firefly-iii/firefly-iiiEPSS 0.4%CVE-2023-33303HIGHA insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands EPSS 0.4%CVE-2026-54779MEDIUMCoreWCF: SAML token replay protection is inoperativeEPSS 0.4%CVE-2023-33005MEDIUMJenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login.EPSS 0.4%CVE-2021-47740MEDIUMKZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration VulnerabilityEPSS 0.4%