{"@ID": "1463", "@Name": "Insufficient Session Timeout Value", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product establishes an authenticated user session, but it does not properly set a timeout for the session. That is, the timeout is set to an excessively large value or is not set at all.", "Technical_Nuance": {"xhtml:p": "There are two types of session timeouts.", "xhtml:ul": {"xhtml:li": ["Inactivity Timeout: The time window that a session will be expired if there is no user interaction within the session.", "Absolute Timeout: Regardless of activity, the total lifetime of a session before it is forcefully expired."]}, "#text_blocks": ["There are two types of session timeouts.", "Inactivity Timeout: The time window that a session will be expired if there is no user interaction within the session.", "Absolute Timeout: Regardless of activity, the total lifetime of a session before it is forcefully expired."]}, "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "1462", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Operating_System": {"@Class": "Not OS-Specific", "@Prevalence": "Undetermined"}, "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": [{"@Class": "Client Server", "@Prevalence": "Undetermined"}, {"@Class": "Web Based", "@Prevalence": "Undetermined"}]}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Common_Consequences": {"Consequence": {"Scope": ["Access Control", "Integrity"], "Impact": "Gain Privileges or Assume Identity", "Note": {"xhtml:p": ["This weakness may improve the likely success of\n\t      certain attacks. For example, an attacker may intercept\n\t      a session ID, possibly via a network sniffer or\n\t      Cross-site Scripting attack. Although short session\n\t      expiration times do not help if a stolen token is\n\t      immediately used, they will protect against ongoing\n\t\treplaying of the session ID.", "In another scenario, a user might access a web site\n\t\t  from a shared computer (such as at a library,\n\t\t  Internet cafe, or open work environment), but forget\n\t\t  to close the pages before leaving. A long expiration\n\t\t  could allow an attacker to use the browser's back\n\t\t  button to access web pages previously accessed by\n\t\t  the victim."], "#text_blocks": ["This weakness may improve the likely success of\n\t      certain attacks. For example, an attacker may intercept\n\t      a session ID, possibly via a network sniffer or\n\t      Cross-site Scripting attack. Although short session\n\t      expiration times do not help if a stolen token is\n\t      immediately used, they will protect against ongoing\n\t\treplaying of the session ID.", "In another scenario, a user might access a web site\n\t\t  from a shared computer (such as at a library,\n\t\t  Internet cafe, or open work environment), but forget\n\t\t  to close the pages before leaving. A long expiration\n\t\t  could allow an attacker to use the browser's back\n\t\t  button to access web pages previously accessed by\n\t\t  the victim."]}}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Implementation", "Description": "Ensure that user sessions have appropriate absolute timeouts set.  The industry standard is between 4 and  8 hours for an absolute timeout [REF-1540]."}, {"Phase": "Implementation", "Description": "Ensure that user sessions have appropriate inactivity timeouts set.  2 to 5 minutes is recommended for high-value applications, and 15-30 minutes for low-risk applications [REF-1540]."}, {"Phase": "Implementation", "Description": "If using an authentication token for a user session, ensure that the token lifetime is configured based on the recommended best practices from the token provider [REF-1563]. There are situations using authentication tokens such as a JWT (Java Web Token) in which the server-side does not handle session timeouts and trusts the values directly from the token.  In this case, it is important that the timeout value is set correctly for the token that is granted."}]}, "Demonstrative_Examples": {"Demonstrative_Example": {"Intro_Text": "The following snippet was taken from a J2EE web.xml deployment descriptor in which the session-timeout parameter is explicitly defined (the default value depends on the container). In this case the value is set to -1, which means that a session will never expire.", "Example_Code": {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "<session-timeout>-1</session-timeout>"}, "#text": "[...snipped...]\n\t\t<session-config></session-config>"}}, "#text": "<web-app></web-app>"}, "#text_blocks": ["<web-app>", "[...snipped...]", "<session-config>", "<session-timeout>-1</session-timeout>", "</session-config>", "</web-app>"]}}}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2026-107275", "Description": "Bad JWT expiration", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-107275"}, {"Reference": "CVE-2025-46344", "Description": "JavaScript SDK does not set an expiration time for JWE tokens related to a session", "Link": "https://www.cve.org/CVERecord?id=CVE-2025-46344"}, {"Reference": "CVE-2024-8888", "Description": "Web interface for a power quality analyzer uses tokens without an expiration date", "Link": "https://www.cve.org/CVERecord?id=CVE-2024-8888"}, {"Reference": "CVE-2024-35206", "Description": "network traffic analyzer for PROFINET networks does not expire sessions", "Link": "https://www.cve.org/CVERecord?id=CVE-2024-35206"}, {"Reference": "CVE-2024-27782", "Description": "AI/ML monitor for IT operations allows re-use of old session tokens due to insufficient session expiration", "Link": "https://www.cve.org/CVERecord?id=CVE-2024-27782"}, {"Reference": "CVE-2020-6291", "Description": "No absolute session expiration", "Link": "https://www.cve.org/CVERecord?id=CVE-2020-6291"}]}, "Functional_Areas": {"Functional_Area": "Session Management"}, "Taxonomy_Mappings": {"Taxonomy_Mapping": {"@Taxonomy_Name": "WASC", "Entry_ID": "47", "Entry_Name": "Insufficient Session Expiration"}}, "References": {"Reference": [{"@External_Reference_ID": "REF-1520"}, {"@External_Reference_ID": "REF-1540"}, {"@External_Reference_ID": "REF-1561"}, {"@External_Reference_ID": "REF-1562"}, {"@External_Reference_ID": "REF-1563"}, {"@External_Reference_ID": "REF-1564"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.\n\t\t\tDo not map to this CWE in situations where the timeout value is set, but the session is incorrectly invalidated; use CWE-1464 instead.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Notes": {"Note": {"@Type": "Maintenance", "@Version": "5.0", "@ReleaseDate": "2026-10-28", "#text": "This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases."}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2026-10-23", "Submission_Version": "5.0", "Submission_ReleaseDate": "2026-10-28"}}, "entry_type": "Weakness"}