CWE-1463
Weakness AllowedInsufficient Session Timeout Value
Abstraction: Base · Status: Incomplete
The product establishes an authenticated user session, but it does not properly set a timeout for the session. That is, the timeout is set to an excessively large value or is not set at all.
Technical nuance
There are two types of session timeouts.
Inactivity Timeout: The time window that a session will be expired if there is no user interaction within the session.
Absolute Timeout: Regardless of activity, the total lifetime of a session before it is forcefully expired.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction. Do not map to this CWE in situations where the timeout value is set, but the session is incorrectly invalidated; use CWE-1464 instead.
Modes of introduction
Notes
Maintenance · CWE 5.0 · 2026-10-28
This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases.
Content history
1 vulnerability references this CWE, most recent first.
CVE-2026-118987 (GCVE-0-2026-118987)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:13 – Updated: 2026-11-06 16:48- CWE-1463 - Insufficient Session Timeout Value
| URL | Tags |
|---|---|
| https://metacpan.org/release/OETIKER/CallBackery-… | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-118987",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:47:39.076054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:48:18.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"CallBackery"
],
"packageName": "CallBackery",
"packageURL": "pkg:cpan/CallBackery",
"programFiles": [
"lib/CallBackery/User.pm"
],
"programRoutines": [
{
"name": "CallBackery::User::cookieConf"
}
],
"repo": "https://github.com/oetiker/callbackery",
"versions": [
{
"lessThan": "0.62.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header.\n\ncookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is.\n\nA session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1463",
"description": "CWE-1463 Insufficient Session Timeout Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:13:11.338Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to CallBackery 0.62.0 or later and set max_session_age in the BACKEND section."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-118987",
"datePublished": "2026-10-30T13:13:11.338Z",
"dateReserved": "2026-10-29T10:48:23.002Z",
"dateUpdated": "2026-11-06T16:48:18.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Ensure that user sessions have appropriate absolute timeouts set. The industry standard is between 4 and 8 hours for an absolute timeout [REF-1540].
Mitigation
Ensure that user sessions have appropriate inactivity timeouts set. 2 to 5 minutes is recommended for high-value applications, and 15-30 minutes for low-risk applications [REF-1540].
Mitigation
If using an authentication token for a user session, ensure that the token lifetime is configured based on the recommended best practices from the token provider [REF-1563]. There are situations using authentication tokens such as a JWT (Java Web Token) in which the server-side does not handle session timeouts and trusts the values directly from the token. In this case, it is important that the timeout value is set correctly for the token that is granted.
No CAPEC attack patterns related to this CWE.