CWE-613
Allowed-with-ReviewInsufficient Session Expiration
Abstraction: Base · Status: Incomplete
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
986 vulnerabilities reference this CWE, most recent first.
GHSA-P7MX-FRQJ-J9HQ
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user's browser via reusing the exposed session token in the application URL.
{
"affected": [],
"aliases": [
"CVE-2017-3966"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-04T13:29:00Z",
"severity": "MODERATE"
},
"details": "Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user\u0027s browser via reusing the exposed session token in the application URL.",
"id": "GHSA-p7mx-frqj-j9hq",
"modified": "2022-05-13T01:36:40Z",
"published": "2022-05-13T01:36:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3966"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10192"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PC62-V6R5-973X
Vulnerability from github – Published: 2025-12-31 00:31 – Updated: 2025-12-31 00:31SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session credentials. Attackers can exploit weak session management to potentially hijack active user sessions and gain unauthorized access to the application.
{
"affected": [],
"aliases": [
"CVE-2022-50692"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-30T23:15:44Z",
"severity": "MODERATE"
},
"details": "SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session credentials. Attackers can exploit weak session management to potentially hijack active user sessions and gain unauthorized access to the application.",
"id": "GHSA-pc62-v6r5-973x",
"modified": "2025-12-31T00:31:10Z",
"published": "2025-12-31T00:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50692"
},
{
"type": "WEB",
"url": "https://cxsecurity.com/issue/WLB-2022120030"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247956"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/170251/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Insufficient-Session-Expiration.html"
},
{
"type": "WEB",
"url": "https://www.sound4.com"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-insufficient-session-expiration-vulnerability"
},
{
"type": "WEB",
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5724.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PF92-7X8P-6X5M
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-05-24 17:44A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue.
{
"affected": [],
"aliases": [
"CVE-2019-3867"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-18T19:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user\u0027s container repository. Red Hat Quay 2 and 3 are vulnerable to this issue.",
"id": "GHSA-pf92-7x8p-6x5m",
"modified": "2022-05-24T17:44:46Z",
"published": "2022-05-24T17:44:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3867"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1772704"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PGPR-4M7F-52MM
Vulnerability from github – Published: 2022-01-14 00:02 – Updated: 2022-02-03 00:00In Mattermost Focalboard, versions prior to v0.7.5, v0.8.4, v0.9.5, v0.10.1 and v0.11.0-rc1; as used respectively in Mattermost, versions prior to v5.37.6, v5.39.3, v6.0.4, v6.1.1 and v6.2.0, are vulnerable to Insufficient Session Expiration. When a user initiates a logout, their session is not invalidated properly. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, to completely take over a victim account.
{
"affected": [],
"aliases": [
"CVE-2022-22122"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-13T17:15:00Z",
"severity": "CRITICAL"
},
"details": "In Mattermost Focalboard, versions prior to v0.7.5, v0.8.4, v0.9.5, v0.10.1 and v0.11.0-rc1; as used respectively in Mattermost, versions prior to v5.37.6, v5.39.3, v6.0.4, v6.1.1 and v6.2.0, are vulnerable to Insufficient Session Expiration. When a user initiates a logout, their session is not invalidated properly. In addition, user sessions are stored in the browser\u2019s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, to completely take over a victim account.",
"id": "GHSA-pgpr-4m7f-52mm",
"modified": "2022-02-03T00:00:50Z",
"published": "2022-01-14T00:02:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22122"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/focalboard/commit/0142c114e9325722d6c8e8ca00f10f0f34dd0409"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/focalboard/commit/0ebc9a4be110764a2510bf886531f21e21b079ea"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/focalboard/commit/2f08c6782762e58e008bd50f3892cb1cdd1be539"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/focalboard/commit/6104de5ba51f79d749b9d5406fde5c2983fc5c5c"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/focalboard/commit/87f4dd224c8736778a8f23788a92471b11da9061"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/focalboard/commit/a2fab2c1d9b3f61871f6da4dc434a2b19ca9552c"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost-server/commit/0a042ca05fefa0584045bab1b7dae102360c98c5"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost-server/commit/5f7fd34956ad5bf7e3697a920e377e11c16dda06"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost-server/commit/6a4c881450973284c3ed98f39bde4809ddd8a758"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost-server/commit/74e87ec3e623202a9654ae164e834cfe26dd6ec3"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost-server/commit/7bc182de9eebb708d62b828213144a1aa4560fa0"
},
{
"type": "WEB",
"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22122"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PJ27-2XVP-4QXG
Vulnerability from github – Published: 2024-05-21 18:09 – Updated: 2024-05-22 13:26Impact
When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set.
This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed.
Patches
Updating to v10.9.0 will solve this.
Workarounds
None
References
Publicly reported at: https://github.com/fastify/session/issues/251
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@fastify/session"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-35220"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-21T18:09:57Z",
"nvd_published_at": "2024-05-21T21:15:08Z",
"severity": "HIGH"
},
"details": "### Impact\n\nWhen restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set.\nThis means a cookie is never correctly detected as expired and thus expired sessions are not destroyed.\n\n### Patches\n\nUpdating to v10.9.0 will solve this.\n\n### Workarounds\n\nNone\n\n### References\n\nPublicly reported at: https://github.com/fastify/session/issues/251",
"id": "GHSA-pj27-2xvp-4qxg",
"modified": "2024-05-22T13:26:11Z",
"published": "2024-05-21T18:09:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fastify/session/security/advisories/GHSA-pj27-2xvp-4qxg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35220"
},
{
"type": "WEB",
"url": "https://github.com/fastify/session/issues/251"
},
{
"type": "WEB",
"url": "https://github.com/fastify/session/commit/0495ce5b534c4550f25228821db8098293439f2f"
},
{
"type": "PACKAGE",
"url": "https://github.com/fastify/session"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "@fastify/session reuses destroyed session cookie"
}
GHSA-PJR6-JX7R-J4R6
Vulnerability from github – Published: 2025-04-29 18:54 – Updated: 2025-04-30 17:25Overview
Auth0 NextJS v4.0.1 to v4.5.0 does not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid.
Am I Affected?
You are affected if you are using Auth0 NextJS SDK v4.
Fix
Upgrade to v4.5.1.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@auth0/nextjs-auth0"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.1"
},
{
"fixed": "4.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-46344"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-29T18:54:49Z",
"nvd_published_at": "2025-04-29T21:15:51Z",
"severity": "MODERATE"
},
"details": "### Overview\nAuth0 NextJS `v4.0.1` to `v4.5.0` does not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid.\n\n### Am I Affected?\nYou are affected if you are using Auth0 NextJS SDK v4.\n\n### Fix\nUpgrade to `v4.5.1`.",
"id": "GHSA-pjr6-jx7r-j4r6",
"modified": "2025-04-30T17:25:56Z",
"published": "2025-04-29T18:54:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-pjr6-jx7r-j4r6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46344"
},
{
"type": "WEB",
"url": "https://github.com/auth0/nextjs-auth0/commit/a4f061aed02ffa132feca8adfbd11704df17e1c3"
},
{
"type": "PACKAGE",
"url": "https://github.com/auth0/nextjs-auth0"
},
{
"type": "WEB",
"url": "https://github.com/auth0/nextjs-auth0/releases/tag/v4.5.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Auth0 NextJS SDK v4 Missing Session Invalidation"
}
GHSA-PMGV-HGV2-W69H
Vulnerability from github – Published: 2026-09-16 18:32 – Updated: 2026-09-21 18:31Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user's outstanding tokens. As a result, a deactivated user retained full access to /ccm/api/1.0/* for the remaining lifetime of any token already issued to them. The same gap applied to accounts that had been deleted or locked pending a forced password reset. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Myq Larson for reporting.
{
"affected": [],
"aliases": [
"CVE-2026-85387"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T18:17:17Z",
"severity": "LOW"
},
"details": "Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server\u0027s authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user\u0027s outstanding tokens. As a result, a deactivated user retained full access to /ccm/api/1.0/* for the remaining lifetime of any token already issued to them. The same gap applied to accounts that had been deleted or locked pending a forced password reset.\u00a0The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Myq Larson for reporting.",
"id": "GHSA-pmgv-hgv2-w69h",
"modified": "2026-09-21T18:31:54Z",
"published": "2026-09-16T18:32:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85387"
},
{
"type": "WEB",
"url": "https://documentation.concretecms.org/developers/introduction/version-history/954-release-notes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PRM3-WVJ6-64VX
Vulnerability from github – Published: 2026-09-16 06:31 – Updated: 2026-09-16 06:31A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually removes the link. An attacker who controls the external identity can exploit this leftover proof to silently re-establish the link and gain unauthorized access to the victims account without any further confirmation.
{
"affected": [],
"aliases": [
"CVE-2026-92358"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T06:16:35Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually removes the link. An attacker who controls the external identity can exploit this leftover proof to silently re-establish the link and gain unauthorized access to the victims account without any further confirmation.",
"id": "GHSA-prm3-wvj6-64vx",
"modified": "2026-09-16T06:31:36Z",
"published": "2026-09-16T06:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92358"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-92358"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PRQ9-W4J8-GG56
Vulnerability from github – Published: 2025-01-07 09:30 – Updated: 2025-07-29 21:30: Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.
{
"affected": [],
"aliases": [
"CVE-2024-11627"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T08:15:24Z",
"severity": "MODERATE"
},
"details": ": Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327,\u00a0from 15.2.8400 through 15.2.8421.",
"id": "GHSA-prq9-w4j8-gg56",
"modified": "2025-07-29T21:30:33Z",
"published": "2025-01-07T09:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11627"
},
{
"type": "WEB",
"url": "https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025"
},
{
"type": "WEB",
"url": "https://www.progress.com/sitefinity-cms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PVJ4-5RHW-5CWW
Vulnerability from github – Published: 2024-08-14 15:31 – Updated: 2024-08-19 18:32The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
{
"affected": [],
"aliases": [
"CVE-2024-39809"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-14T15:15:26Z",
"severity": "HIGH"
},
"details": "The Central Manager user session refresh token does not expire when a user logs out.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated",
"id": "GHSA-pvj4-5rhw-5cww",
"modified": "2024-08-19T18:32:05Z",
"published": "2024-08-14T15:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39809"
},
{
"type": "WEB",
"url": "https://my.f5.com/manage/s/article/K000140111"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Set sessions/credentials expiration date.
No CAPEC attack patterns related to this CWE.