Fallos del tipo CWE-613

475 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2025-62329MEDIUMHCL DevOps Deploy / HCL Launch is susceptible to an insufficient session expiration vulnerabilityEPSS 0.2%CVE-2025-36360MEDIUMIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Insufficient Session Expiration vulnerabilityEPSS 0.2%CVE-2025-24973CRITICALConcorde not removing authentication tokens after logging outEPSS 0.2%CVE-2025-62342MEDIUMHCL IntelliOps Event Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2026-42421LOWOpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token RotationEPSS 0.2%CVE-2026-55513MEDIUMnebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensEPSS 0.2%CVE-2026-41356LOWOpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotateEPSS 0.2%CVE-2025-55278HIGHHCL DevOps Loop is susceptible to an improper authentication vulnerabilityEPSS 0.2%CVE-2026-27968MEDIUMPackistry accepts expired access tokensEPSS 0.2%CVE-2026-92920MEDIUMadmin3 through 3.0.0 Session Not Invalidated When a User Account Is DisabledEPSS 0.2%CVE-2025-31962LOWHCL BigFix IVR is impacted by an insufficient session expiration vulnerabilityEPSS 0.2%CVE-2021-27751MEDIUMHCL Commerce is affected by an Insufficient Session Expiration vulnerability.EPSS 0.2%CVE-2026-34454LOWOAuth2 Proxy: Session cookie not cleared when rendering sign-in pageEPSS 0.2%CVE-2025-36065MEDIUMMultiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.EPSS 0.2%CVE-2026-28396MEDIUMNocoDB: Refresh Tokens Not Revoked on Password ResetEPSS 0.2%CVE-2026-53824MEDIUMMattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh DelayEPSS 0.2%CVE-2026-0971MEDIUMGoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeoutEPSS 0.2%CVE-2024-1623HIGHInsufficient session timeout vulnerability in Sagemcom routerEPSS 0.2%CVE-2025-52661LOWHCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resultiEPSS 0.2%CVE-2026-1815MEDIUMSession Hijacking in TEİAŞ's Mobile ApplicationEPSS 0.2%