Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for...
CVE-2026-73180
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP se
#cwe-613
共收录 231 条相关情报。
← 返回所有主题Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been e...
CVE-2026-73180
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP se
Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three...
CVE-2026-79664
Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintai
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token....
CVE-2026-77130
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. e...
CVE-2026-75554
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from
An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associ...
CVE-2026-14950
An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session aft
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data t...
CVE-2026-65984
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in ser
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.passwo...
CVE-2026-45791
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previo...
CVE-2026-73611
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configure
Credentials for a deleted user may remain valid for a short period under specific conditions.
CVE-2026-66376
Credentials for a deleted user may remain valid for a short period under specific conditions.
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke...
CVE-2026-17600
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissio
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or ...
CVE-2026-17600
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissio
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the `/logout` page, ...
CVE-2026-48079
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This ...
CVE-2025-12317
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issue
OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry
CVE-2026-48079
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver
The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an ac...
CVE-2025-12627
The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated
Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them t...
CVE-2024-8995
Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This a
Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning admin...
CVE-2026-60053
Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Admin
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate R...
CVE-2026-66400
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php wh
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session...
CVE-2026-14996
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.