Fallos del tipo CWE-613

549 resultados

Expiração de Sessão Inadequada

A aplicação não valida ou reforça corretamente o tempo de vida de uma sessão de usuário, permitindo que sessões expiradas ou mal gerenciadas continuem sendo aceitas. Isso abre brecha para roubo de sessão, fixação de sessão ou acesso não autorizado após logout.

Ejemplo

Um usuário faz login em um banco online e recebe um token de sessão. A aplicação não verifica se o token expirou no servidor, então mesmo após 24 horas de inatividade, aquele token continua funcional — um atacante que capturar o token pode acessar a conta indefinidamente.

Cómo mitigar

Implemente timeout rigoroso no servidor (revogue tokens expirados), valide a expiração a cada requisição, use session store confiável (Redis, BD), regenere IDs após login/logout, e considere tokens com TTL curto ou refresh tokens com rotação automática.

CVE-2026-24894HIGHFrankenPHP leaks session data between requests in worker modeEPSS 0.5%CVE-2021-46279MEDIUMSession Fixation and Insufficient Session ExpirationEPSS 0.5%CVE-2024-45187HIGHMage AI allows deleted users to use the terminal server with admin access, leading to remote code executionEPSS 0.5%CVE-2025-49152HIGHInsufficient Session Expiration in MICROSENS NMP Web+EPSS 0.5%CVE-2026-74037HIGHWazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_tokenEPSS 0.5%CVE-2024-29402MEDIUMcskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity.EPSS 0.5%CVE-2022-24744LOWInsufficient Session Expiration in shopwareEPSS 0.5%CVE-2023-4005LOWInsufficient Session Expiration in fossbilling/fossbillingEPSS 0.5%CVE-2023-41041LOWUser session is still usable after logout in graylog2-server EPSS 0.5%CVE-2024-52311MEDIUMdata.all does not invalidate authentication token upon user logoutEPSS 0.5%CVE-2024-0350LOWSourceCodester Engineers Online Portal session expirationEPSS 0.5%CVE-2026-27575CRITICALVijkunja has Weak Password Policy Combined with Persistent Sessions After Password ChangeEPSS 0.5%CVE-2026-55617MEDIUMHydro: Insufficient session expiration when recreating sessionsEPSS 0.5%CVE-2026-63175HIGHCross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCaptureEPSS 0.5%CVE-2025-46815HIGHZITADEL Allows IdP Intent Token ReuseEPSS 0.5%CVE-2022-47406MEDIUMAn issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPOEPSS 0.5%CVE-2021-47663HIGHImproper session handlingEPSS 0.5%CVE-2026-9705MEDIUMKeycloak: keycloak: attacker can re-enable and take over disabled clients via registration access tokenEPSS 0.5%CVE-2022-39234MEDIUMuser session persists even after permanently deleting account in GLPIEPSS 0.5%CVE-2026-75907HIGHCVE-2026-75907EPSS 0.5%