Common Weakness Enumeration
CWE-613
Allowed-with-ReviewInsufficient Session Expiration
Abstraction: Base · Status: Incomplete
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
980 vulnerabilities reference this CWE, most recent first.
GHSA-4X9V-95W9-XP83
Vulnerability from github – Published: 2023-06-16 09:30 – Updated: 2024-04-04 04:54
VLAI
Details
Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.
Severity
6.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-2788"
],
"database_specific": {
"cwe_ids": [
"CWE-613",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-16T09:15:09Z",
"severity": "MODERATE"
},
"details": "Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker\u0027s account is deactivated.\n\n",
"id": "GHSA-4x9v-95w9-xp83",
"modified": "2024-04-04T04:54:24Z",
"published": "2023-06-16T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2788"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-523Q-32QM-5JPF
Vulnerability from github – Published: 2025-11-18 18:32 – Updated: 2025-11-19 18:31
VLAI
Details
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a token is compromised. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-56643"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-18T18:16:07Z",
"severity": "CRITICAL"
},
"details": "Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a token is compromised. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism.",
"id": "GHSA-523q-32qm-5jpf",
"modified": "2025-11-19T18:31:18Z",
"published": "2025-11-18T18:32:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56643"
},
{
"type": "WEB",
"url": "https://github.com/0xBS0D27/CVE-2025-56643"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5297-WRRP-RCJ7
Vulnerability from github – Published: 2024-04-08 15:48 – Updated: 2024-04-08 18:34
VLAI
Summary
Shopware Improper Session Handling in store-api account logout
Details
Impact
When a authentificated request is made to POST /store-api/account/logout, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on CustomerLogoutEvent and invalidates the session additionally.
Patches
The problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8.
Workarounds
When you are not able to update, you can install the latest version of the Shopware Security Plugin.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "shopware/core"
},
"ranges": [
{
"events": [
{
"introduced": "6.3.5.0"
},
{
"fixed": "6.5.8.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "shopware/platform"
},
"ranges": [
{
"events": [
{
"introduced": "6.3.5.0"
},
{
"fixed": "6.5.8.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "shopware/core"
},
"ranges": [
{
"events": [
{
"introduced": "6.6.0.0-rc1"
},
{
"fixed": "6.6.1.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "shopware/platform"
},
"ranges": [
{
"events": [
{
"introduced": "6.6.0.0-rc1"
},
{
"fixed": "6.6.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-31447"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-08T15:48:27Z",
"nvd_published_at": "2024-04-08T16:15:08Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nWhen a authentificated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won\u0027t be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. \n\n### Patches\nThe problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8.\n\n### Workarounds\nWhen you are not able to update, you can install the latest version of the Shopware Security Plugin.\n",
"id": "GHSA-5297-wrrp-rcj7",
"modified": "2024-04-08T18:34:00Z",
"published": "2024-04-08T15:48:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31447"
},
{
"type": "WEB",
"url": "https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77"
},
{
"type": "WEB",
"url": "https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3"
},
{
"type": "PACKAGE",
"url": "https://github.com/shopware/shopware"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Shopware Improper Session Handling in store-api account logout"
}
GHSA-52GH-Q32V-JM2R
Vulnerability from github – Published: 2022-11-22 21:30 – Updated: 2022-11-26 06:31
VLAI
Details
IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235527.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-40228"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-22T19:15:00Z",
"severity": "MODERATE"
},
"details": "IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235527.",
"id": "GHSA-52gh-q32v-jm2r",
"modified": "2022-11-26T06:31:18Z",
"published": "2022-11-22T21:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40228"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/235527"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6840759"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-53HQ-PWC4-H68H
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2022-05-24 17:33
VLAI
Details
Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active.
{
"affected": [],
"aliases": [
"CVE-2020-23140"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-09T18:15:00Z",
"severity": "HIGH"
},
"details": "Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active.",
"id": "GHSA-53hq-pwc4-h68h",
"modified": "2022-05-24T17:33:54Z",
"published": "2022-05-24T17:33:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23140"
},
{
"type": "WEB",
"url": "https://gist.github.com/virendratiwari03/bddafb3cd82dde8202bd056d340d3e36"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-53MM-HX32-6475
Vulnerability from github – Published: 2022-12-14 21:30 – Updated: 2022-12-19 21:10
VLAI
Summary
TYPO3 vulnerable to Insufficient Session Expiration
Details
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "derhansen/fe_change_pwd"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "derhansen/fe_change_pwd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-47406"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-19T21:10:07Z",
"nvd_published_at": "2022-12-14T21:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.",
"id": "GHSA-53mm-hx32-6475",
"modified": "2022-12-19T21:10:07Z",
"published": "2022-12-14T21:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47406"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/derhansen/fe_change_pwd/CVE-2022-47406.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/TYPO3/typo3"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2022-016"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "TYPO3 vulnerable to Insufficient Session Expiration"
}
GHSA-53X4-P5J7-29Q6
Vulnerability from github – Published: 2026-08-05 18:31 – Updated: 2026-08-07 00:31
VLAI
Details
Insufficient Session Expiration vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-60053"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-05T16:16:58Z",
"severity": "CRITICAL"
},
"details": "Insufficient Session Expiration vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 2.0.1.\n\nAdministrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed.\nUsers are recommended to upgrade to version 2.0.2, which fixes the issue.",
"id": "GHSA-53x4-p5j7-29q6",
"modified": "2026-08-07T00:31:08Z",
"published": "2026-08-05T18:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60053"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/05/14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-55C7-JCXX-6JXX
Vulnerability from github – Published: 2022-05-04 00:00 – Updated: 2022-05-04 00:00
VLAI
Details
In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-23063"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-03T09:15:00Z",
"severity": "HIGH"
},
"details": "In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.",
"id": "GHSA-55c7-jcxx-6jxx",
"modified": "2022-05-04T00:00:24Z",
"published": "2022-05-04T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23063"
},
{
"type": "WEB",
"url": "https://github.com/shopizer-ecommerce/shopizer/blob/3.0.1/sm-shop/src/main/java/com/salesmanager/shop/store/api/v1/customer/AuthenticateCustomerApi.java#L213-L237"
},
{
"type": "WEB",
"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23063"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5765-9MM7-GG46
Vulnerability from github – Published: 2024-05-03 21:30 – Updated: 2024-05-03 21:30
VLAI
Details
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 264938.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-40695"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T19:15:07Z",
"severity": "MODERATE"
},
"details": "IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 264938.",
"id": "GHSA-5765-9mm7-gg46",
"modified": "2024-05-03T21:30:30Z",
"published": "2024-05-03T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40695"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/264938"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7149876"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-57GG-CJ55-Q5G2
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2026-01-16 21:48
VLAI
Summary
Token leases could outlive their TTL in HashiCorp Vault
Details
HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/vault"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0-beta1"
},
{
"fixed": "1.5.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-25816"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-01T21:49:26Z",
"nvd_published_at": "2020-09-30T20:15:00Z",
"severity": "CRITICAL"
},
"details": "HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.",
"id": "GHSA-57gg-cj55-q5g2",
"modified": "2026-01-16T21:48:17Z",
"published": "2022-05-24T22:01:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25816"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/vault/pull/10020/commits/f192878110fe93eb13da914b2bee28caa7866a29"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp/vault"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#147"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#154"
},
{
"type": "WEB",
"url": "https://www.hashicorp.com/blog/category/vault"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Token leases could outlive their TTL in HashiCorp Vault"
}
Mitigation
Implementation
Set sessions/credentials expiration date.
No CAPEC attack patterns related to this CWE.