Fallos del tipo CWE-613

475 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2026-34362MEDIUMAVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()EPSS 0.2%CVE-2026-43983HIGHPocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictionsEPSS 0.2%CVE-2025-64708MEDIUMauthentik invitation expiry is delayed by at least 5 minutesEPSS 0.2%CVE-2026-75554LOWExplicit organization scopes survive token refresh after membership endsEPSS 0.2%CVE-2026-41902CRITICALFreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaksEPSS 0.2%CVE-2026-17600HIGHNexus Repository 3 - Session Not Invalidated on User Account Deletion or DeactivationEPSS 0.2%CVE-2025-68954HIGHPterodactyl does not revoke SFTP access when server is deleted or permissions reducedEPSS 0.2%CVE-2026-92800HIGHDocs before 5.4.1 Stale Collaboration Session After Access RevocationEPSS 0.2%CVE-2026-40587MEDIUMblueprintUE: Active Sessions Are Not Invalidated After Password Change or ResetEPSS 0.2%CVE-2025-14810MEDIUMIBM InfoSphere Information Server is vulnerable due to insufficient session expirationEPSS 0.2%CVE-2025-12317MEDIUMImproper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access PrivilegesEPSS 0.2%CVE-2023-45659LOWSession is not expiring after password reset in EngelsystemEPSS 0.2%CVE-2024-43181MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.2%CVE-2026-35462MEDIUMPapra Does Not Reject Expired API KeysEPSS 0.2%CVE-2026-61608MEDIUMSolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation linksEPSS 0.2%CVE-2026-29092MEDIUMKiteworks Email Protection Gateway has an Insufficient Session ExpirationEPSS 0.2%CVE-2025-11429MEDIUMKeycloak-server: too long and not settings compliant sessionEPSS 0.2%CVE-2026-82469MEDIUMRodauth before 2.47.0 Authentication Bypass via jwt_refreshEPSS 0.2%CVE-2024-56413MEDIUMMissing session invalidation after user deletion. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169EPSS 0.2%CVE-2025-32441MEDIUMRack session gets restored after deletionEPSS 0.2%