Falhas do tipo CWE-613

475 resultados

Expiração de Sessão Inadequada

Ocorre quando uma aplicação não encerra ou valida corretamente a sessão de um usuário após um período de inatividade ou quando deveria invalidá-la. Um atacante pode reutilizar um token de sessão expirado ou abandonado para se passar pelo usuário legítimo, contornando autenticação.

Exemplo

Um usuário faz login em um banco online, depois sai do navegador sem fazer logout. Horas depois, alguém acessa o histórico do navegador, encontra o cookie de sessão ainda válido e consegue acessar a conta bancária sem inserir credenciais novamente.

Como mitigar

Implemente timeout de sessão no servidor (invalide a sessão após X minutos de inatividade), force novo login em operações sensíveis, use tokens com expiração explícita (JWT com exp claim) e limpe cookies/tokens no logout. Sempre valide a sessão no lado do servidor antes de processar requisições.

CVE-2026-92378MEDIUMuniFLOW Online Legacy UI Previous login session retained when entering Reduced Function LoginEPSS 0.2%CVE-2025-43819MEDIUMA Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4EPSS 0.2%CVE-2025-12624MEDIUMImproper Token Invalidation in WSO2 Identity Server Allows Access After Account LockEPSS 0.2%CVE-2025-66483MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2025-4407MEDIUMApplication does not invalidate session after password resetEPSS 0.2%CVE-2024-41985LOWA vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=EPSS 0.2%CVE-2026-80174MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient SessEPSS 0.2%CVE-2025-36063MEDIUMMultiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.EPSS 0.2%CVE-2022-38707MEDIUMIBM Cognos Command Center information disclosureEPSS 0.2%CVE-2025-53642MEDIUMhaxcms-nodejs and haxcms-php Improperly Terminate SessionsEPSS 0.2%CVE-2025-65430MEDIUMAn issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user whEPSS 0.2%CVE-2022-34392MEDIUM SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An authenticated non-adminEPSS 0.2%CVE-2025-62781MEDIUMPILOS is missing session regeneration after password changeEPSS 0.2%CVE-2026-6515MEDIUMInsufficient Session Expiration in GitLabEPSS 0.2%CVE-2026-66376MEDIUMDeleted users may temporarily retain access to JFrog ArtifactoryEPSS 0.2%CVE-2025-27898MEDIUMMultiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsEPSS 0.2%CVE-2026-24669HIGHOpen eClass Insecure Password Reset Token Reuse Enables Account TakeoverEPSS 0.2%CVE-2023-40732LOWA vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not inEPSS 0.2%CVE-2026-16970MEDIUMDFIR-IRIS Insufficient Logout ImplementationEPSS 0.2%CVE-2024-40683MEDIUMIBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password changeEPSS 0.2%