CWE-613

Insufficient Session Expiration

Parent: CWE-672 - Operation on a Resource after Expiration or Release

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

575 vulnerabilities with CWE-613
CVE-2026-25711 HIGH
WebSocket Backend - Session Hijacking
CVSS 7.3
CVE-2026-20895 HIGH
WebSocket Backend - Session Hijacking
CVSS 7.3
CVE-2026-28275 HIGH
Initiative < 0.32.4 - Insufficient Session Expiration via JWT Token Invalidation
CVSS 8.1
CVE-2026-27968 MEDIUM
packistry < 0.13.0 - Improper Authentication via Expired Deploy Token
CVSS 4.3
CVE-2026-27933 MEDIUM
Manyfold < 0.133.0 - Session Hijack via Proxy Cache Cookie Leakage
CVSS 6.8
CVE-2026-27575 CRITICAL
Vikunja < 2.0.0 - Insufficient Session Expiration and Weak Password Enforcement
CVSS 9.1
CVE-2026-25476 HIGH
OpenEMR < 8.0.0 - Insufficient Session Expiration via skip_timeout_reset Parameter
CVSS 7.5
CVE-2026-26342 CRITICAL
Tattile Smart+/Vega/Basic <1.181.5 - Auth Bypass
CVSS 9.8
CVE-2026-1842 MEDIUM
HyperCloud 2.3.5-2.6.8 - Auth Bypass
CVE-2026-1435 CRITICAL
Graylog Web Interface 2.2.3 - Auth Bypass
CVSS 9.8
CVE-2026-24894 HIGH
FrankenPHP <1.11.2 - Info Disclosure
CVSS 7.5
CVE-2026-24669 HIGH
Open eClass <4.2 - Privilege Escalation
CVSS 7.8
CVE-2026-24667 MEDIUM
Open eClass Platform < 4.2 - Insufficient Session Expiration after Password Change
CVSS 5.0
CVE-2026-24472 MEDIUM
Hono < 4.11.7 - Information Disclosure via Cache Middleware
CVSS 5.3
CVE-2025-36359 HIGH
IBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.
CVSS 8.1
CVE-2025-71335 HIGH
Flowise - Session Invalidation Failure After Password Change
CVSS 8.1
CVE-2025-62340 LOW
HCL iControl was affected by Inadequate Session Timeout vulnerability
CVSS 3.1
CVE-2025-12624 MEDIUM
Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock
CVSS 6.0
CVE-2025-57735 CRITICAL
Apache Airflow: Airflow Logout Not Invalidating JWT
CVSS 9.1
CVE-2025-66483 MEDIUM
IBM Aspera Shares 1.9.9-1.11.0 - Session Not Invalidated After Password Reset
CVSS 6.3
CVE-2025-55264 MEDIUM
HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change
CVSS 5.5
CVE-2025-14810 MEDIUM
IBM InfoSphere Information Server is vulnerable due to insufficient session expiration
CVSS 6.3
CVE-2025-15553 HIGH
Insecure Logout Functionality in Truesec LAPSWebUI
CVSS 7.1
CVE-2025-15552 HIGH
Long Session Lifetime in Truesec LAPSWebUI
CVSS 7.8
CVE-2025-59786 CRITICAL
2N Access Commander <3.4.2 - Auth Bypass
CVSS 9.8
Details
Vulnerabilities 575
Links
MITRE CWE Entry Search this CWE With Exploits