Fallos del tipo CWE-613

474 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2025-58352LOWWeblate has long session expiry times during second factor verificationEPSS 0.3%CVE-2021-22136—In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout settinEPSS 0.3%CVE-2026-14227MEDIUMInsufficient session expiration in MikroTik RouterOSEPSS 0.3%CVE-2026-92358MEDIUMKeycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linkingEPSS 0.3%CVE-2026-71206HIGHshiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or DemotionEPSS 0.3%CVE-2025-12110MEDIUMKeycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removedEPSS 0.3%CVE-2026-44553HIGHOpen WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note AccessEPSS 0.3%CVE-2025-35433LOWCISA Thorium does not properly invalidate previously used tokensEPSS 0.3%CVE-2026-51953HIGHAn issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handlEPSS 0.3%CVE-2025-66289HIGHOrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password ChangeEPSS 0.3%CVE-2026-53843HIGHOpenClaw < 2026.5.26 - Node Token Revocation Bypass via Pairing-Scoped Device SessionEPSS 0.3%CVE-2025-30516LOWUnauthorized Notification Exposure in Mobile App Under Specific ConditionsEPSS 0.3%CVE-2026-92976MEDIUMStored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0EPSS 0.3%CVE-2026-22706LOWStrapi: Password Reset Does Not Revoke Existing Refresh SessionsEPSS 0.3%CVE-2026-55617MEDIUMHydro: Insufficient session expiration when recreating sessionsEPSS 0.3%CVE-2025-66223HIGHOpenObserve's Invite Token Lifecycle MisconfigurationEPSS 0.3%CVE-2026-46657HIGHBludit's persistent authentication tokens not revoked upon account disablementEPSS 0.3%CVE-2026-41519MEDIUMWeblate's API Token Not Invalidated on Password ChangeEPSS 0.3%CVE-2026-41891MEDIUMCI4MS: Deactivated User Session Bypass (active=0)EPSS 0.3%CVE-2024-57056MEDIUMIncorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could bEPSS 0.3%