Fallos del tipo CWE-613

553 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2019-14826MEDIUMA flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this EPSS 0.3%CVE-2026-14996HIGHMultiple vulnerabilities in IBM Aspera FaspexEPSS 0.3%CVE-2026-9162MEDIUMGlobal session revocation does not invalidate active WebSocket connectionsEPSS 0.3%CVE-2026-30224MEDIUMOliveTin: Session Fixation - Logout Fails to Invalidate Server-Side SessionEPSS 0.3%CVE-2025-55705HIGHEVMAPA Insufficient Session ExpirationEPSS 0.3%CVE-2026-40934HIGHjupyter-server authentication cookies remain valid after password reset due to static cookie secretEPSS 0.3%CVE-2025-1968HIGHInsufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allEPSS 0.3%CVE-2024-11627MEDIUM: Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 thrEPSS 0.3%CVE-2025-36359HIGHIBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.EPSS 0.3%CVE-2024-35206HIGHA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected application does not EPSS 0.3%CVE-2026-41133HIGHpyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)EPSS 0.3%CVE-2026-100711HIGHfroxlor before 2.3.12 Authentication Bypass via Session PersistenceEPSS 0.3%CVE-2025-2185HIGHALBEDO Telecom Net.Time - PTP/NTP Clock Insufficient Session ExpirationEPSS 0.3%CVE-2024-23586MEDIUMAn insufficient session timeout vulnerability affects HCL Nomad server on DominoEPSS 0.3%CVE-2021-31408MEDIUMServer session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19EPSS 0.3%CVE-2026-61608MEDIUMSolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation linksEPSS 0.3%CVE-2026-55513MEDIUMnebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensEPSS 0.3%CVE-2026-49229HIGHActual: Disabled OpenID users keep access through existing session tokensEPSS 0.3%CVE-2026-92920MEDIUMadmin3 through 3.0.0 Session Not Invalidated When a User Account Is DisabledEPSS 0.3%CVE-2026-56664MEDIUMZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP ProviderEPSS 0.3%