Fallos del tipo CWE-613

472 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2026-26342HIGHTattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token ExpirationEPSS 0.7%CVE-2024-21492MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user sessioEPSS 0.7%CVE-2024-35050HIGHAn issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin.EPSS 0.7%CVE-2020-15220MEDIUMSession fixationEPSS 0.7%CVE-2026-46455CRITICALApache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be acceptedEPSS 0.7%CVE-2022-43844HIGHIBM Robotic Process Automation for Cloud Pak session fixationEPSS 0.7%CVE-2026-28564CRITICALApache IoTDB: REST Basic Authentication Accepts Stale Cached CredentialsEPSS 0.7%CVE-2022-46177MEDIUMDiscourse password reset link can lead to in account takeover if user changes to a new emailEPSS 0.7%CVE-2022-41542MEDIUMdevhub 0.102.0 was discovered to contain a broken session control.EPSS 0.7%CVE-2025-57735CRITICALApache Airflow: Airflow Logout Not Invalidating JWTEPSS 0.7%CVE-2024-0942LOWTotolink N200RE V5 cstecgi.cgi session expirationEPSS 0.7%CVE-2022-35728HIGHiControl REST vulnerability CVE-2022-35728EPSS 0.7%CVE-2023-0227HIGHInsufficient Session Expiration in pyload/pyloadEPSS 0.7%CVE-2023-4320HIGHSatellite: arithmetic overflow in satelliteEPSS 0.7%CVE-2022-4070LOWInsufficient Session Expiration in librenms/librenmsEPSS 0.6%CVE-2026-86533CRITICALRevoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixEPSS 0.6%CVE-2021-43791MEDIUMIneffective expiration validation for invitation links in ZulipEPSS 0.6%CVE-2024-27455CRITICALIn the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attemptsEPSS 0.6%CVE-2024-52553HIGHJenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.EPSS 0.6%CVE-2023-31139MEDIUMDHIS2 Core unrestricted session cookies with Personal Access TokensEPSS 0.6%