CWE-613

{
  "affected": [],
  "aliases": [
    "CVE-2021-35034"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-29T13:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted.",
  "id": "GHSA-38gc-w4h9-7pmf",
  "modified": "2022-01-08T00:00:41Z",
  "published": "2021-12-30T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35034"
    },
    {
      "type": "WEB",
      "url": "https://www.zyxel.com/support/Zyxel_security_advisory_for_sensitive_information_vulnerabilities_of_NBG6604_home_router.shtml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.6.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.10.0"
            },
            {
              "fixed": "1.5.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-32923"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-04T18:42:40Z",
    "nvd_published_at": "2021-06-03T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.",
  "id": "GHSA-38j9-7pp9-2hjw",
  "modified": "2021-06-17T20:00:42Z",
  "published": "2021-06-08T18:52:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32923"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2021-15-vault-renewed-nearly-expired-leases-with-incorrect-non-expiring-ttls/24603"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202207-01"
    },
    {
      "type": "WEB",
      "url": "https://www.hashicorp.com/blog/category/vault"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Invalid session token expiration "
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0944"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-26T20:15:54Z",
    "severity": "LOW"
  },
  "details": "A vulnerability was found in Totolink T8 4.1.5cu.833_20220905. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252188. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-38xm-rj5r-36vx",
  "modified": "2024-04-01T09:30:31Z",
  "published": "2024-01-26T21:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0944"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1YPisSnxM5CwSLKFgs9w5k5MtNUgiijVo/view?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.252188"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.252188"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.269681"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@better-auth/oauth-provider"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.6.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "better-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.8-beta.7"
            },
            {
              "fixed": "1.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53517"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294",
      "CWE-362",
      "CWE-367",
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T20:55:48Z",
    "nvd_published_at": "2026-07-15T18:16:48Z",
    "severity": "HIGH"
  },
  "details": "### Am I affected?\n\nUsers are affected if all of the following are true:\n\n- Their project depends on `@better-auth/oauth-provider` at a version `\u003e= 1.6.0, \u003c 1.6.11`, or uses the embedded plugin in `better-auth \u003e= 1.4.8-beta.7, \u003c 1.6.0`.\n- At least one OAuth client served by their application\u0027s authorization server requests the `offline_access` scope, so refresh tokens are minted.\n- Concurrent redemption of the same refresh token is reachable: an SPA shares one refresh token across browser tabs without a mutex, a mobile client retries after a transient failure, an attacker who has stolen a refresh token times two requests, or a service worker queues offline requests.\n\nIf developer applications do not request `offline_access` for any client, no refresh tokens are minted and they are not exposed.\n\nFix:\n\n1. Upgrade to `@better-auth/oauth-provider@1.6.11` or later.\n2. If developers cannot upgrade, see workarounds below.\n\n### Summary\n\nThe OAuth provider\u0027s `POST /oauth2/token` endpoint, on the `refresh_token` grant, performs a non-atomic read / validate / revoke / mint sequence on the `oauthRefreshToken` row. Two concurrent requests presenting the same parent refresh token both pass the revocation check before either revoke completes, so each mints a fresh refresh token. The replay-detection branch only fires when `revoked` is already truthy at read time, which is exactly the state concurrent attackers race past. The result is a forked refresh-token family from a single parent token.\n\n### Details\n\nThe `adapter.update` predicate on the parent row is keyed on `id` only; it does not include `revoked IS NULL`, so two concurrent updates both succeed (last-write-wins, no error path). The schema does not declare `unique` on `oauthRefreshToken.token`, so concurrent creates do not collide on a unique-key violation either.\n\nRFC 9700 \u00a74.14 (OAuth Security Best Current Practice) prescribes refresh-token family invalidation on detected reuse; this implementation tries to enforce that contract through the `revoked` check, but the check is not atomic with the consumption step. Token rotation issues a new refresh token with each call, so a single stolen refresh token grants indefinite access until the row is revoked or its `refreshTokenExpiresAt` (default 7 days) passes. Rotation refreshes that window each call.\n\nThe fix lands an atomic compare-and-swap on the parent row inside the rotation primitive (`UPDATE ... WHERE id = ? AND revoked IS NULL` with a rowcount check), so the losing rotation fails closed with `invalid_grant` and the parent row stays marked revoked. Subsequent replay of the original refresh token then trips the existing family-invalidation guard. The schema gains a unique constraint on `oauthRefreshToken.token` for parity with `oauthAccessToken.token`.\n\n### Patches\n\nFixed in `@better-auth/oauth-provider@1.6.11`. The refresh-token rotation primitive now performs an atomic compare-and-swap on the parent row, and the explicit `revokeRefreshToken` path uses the same CAS. On a contested rotation, exactly one caller wins and mints a fresh refresh token; the loser receives `invalid_grant`. Subsequent replay of the original refresh token trips the existing family-invalidation guard because the parent row stays marked revoked.\n\n`@better-auth/memory-adapter@1.6.11` ships a compatibility fix in the same wave: the in-memory `where` clause now treats `undefined` and `null` as equivalent under an `eq null` predicate, mirroring SQL `IS NULL` and Mongo\u0027s missing-or-null semantics. Without this change, the CAS predicate `WHERE revoked IS NULL` falls through on every call against a row whose optional `revoked` field is absent (the adapter factory\u0027s `transformInput` skips writing `undefined` when no default exists), so the rotation above is broken for any deployment using the in-memory adapter.\n\nStrict refresh-token family invalidation on a contested rotation, per RFC 9700 \u00a74.14 (which calls for invalidating the winner\u0027s tokens too when reuse is detected at rotation time), is deferred to a follow-up minor on the `next` channel. Closing it cleanly requires an opt-in transactional rotation in the adapter contract so the family-delete cannot interleave with the winner\u0027s in-flight access-token insert. The deferred site carries a `FIXME(strict-family-invalidation)` marker.\n\nSchema-migration note: the better-auth migration generator only emits `UNIQUE` for newly-created columns. Existing installs will not pick up the new `oauthRefreshToken.token` unique constraint from `migrate` / `generate`; add it manually if an application\u0027s operational tooling depends on it (`CREATE UNIQUE INDEX oauth_refresh_token_token_uniq ON \"oauthRefreshToken\" (token);`). The CAS fix above does not depend on the database-level constraint to be correct; the constraint is defense-in-depth so collisions from a buggy custom `generateRefreshToken` callback fail loudly.\n\n### Workarounds\n\nNone of these close the bug fully without a code patch.\n\n- **Adapter-level**: configure the database adapter to run the OAuth refresh handler under serializable isolation, or wrap the `adapter.update` on `oauthRefreshToken` with a row-level pessimistic lock (`SELECT ... FOR UPDATE`). Narrows the window without closing it.\n- **Token lifetime**: pass `oauthProvider({ refreshTokenExpiresIn: 60 })` to expire forked families within one minute. Trades attacker persistence for shorter user sessions.\n- **Client-side single-flight**: serialize refresh-token usage in the client SDK with a mutex. Mitigates honest concurrency but does nothing against an attacker with a stolen refresh token.\n- **Disable refresh tokens**: do not request the `offline_access` scope. Closes the surface but breaks long-lived sessions.\n\n### Impact\n\n- **Indefinite access from a single stolen refresh token**: forked refresh-token families grant access at the original user\u0027s authorization scope, surviving past any single revocation if an attacker holds any branch.\n- **Detection bypass**: legitimate users whose refresh token has been forked do not trip family invalidation when they refresh, because the attacker\u0027s branch already swapped the parent row out from under the legitimate user\u0027s check.\n\n### Credit\n\nReported by @chdanielmueller.\n\n### Resources\n\n- [CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)](https://cwe.mitre.org/data/definitions/362.html)\n- [CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition](https://cwe.mitre.org/data/definitions/367.html)\n- [CWE-294: Authentication Bypass by Capture-replay](https://cwe.mitre.org/data/definitions/294.html)\n- [CWE-613: Insufficient Session Expiration](https://cwe.mitre.org/data/definitions/613.html)\n- [RFC 9700 \u00a74.14: Refresh Token Protection](https://datatracker.ietf.org/doc/html/rfc9700#section-4.14)\n- [RFC 6749 \u00a76: Refreshing an Access Token](https://datatracker.ietf.org/doc/html/rfc6749#section-6)",
  "id": "GHSA-392p-2q2v-4372",
  "modified": "2026-07-20T19:24:47Z",
  "published": "2026-07-07T20:55:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-392p-2q2v-4372"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53517"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/commit/c6918ecc9e3a75892169415d7f6c95b591b6a52d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/better-auth/better-auth"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/releases/tag/v1.6.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/releases/tag/v1.6.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-46158"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-25T18:17:37Z",
    "severity": "CRITICAL"
  },
  "details": "IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling.  IBM X-Force ID:  268775.",
  "id": "GHSA-3942-82qw-f9qh",
  "modified": "2023-11-01T18:30:32Z",
  "published": "2023-10-25T18:32:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46158"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/268775"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7058356"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.vikunja.io/api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.24.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27575"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-521",
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-25T22:02:37Z",
    "nvd_published_at": "2026-02-25T22:16:26Z",
    "severity": "CRITICAL"
  },
  "details": "**Summary**\nThe application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password.\n\nAn attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password.\n\n\n**Details**\n\n1. Weak passwords are accepted during registration and password change.\n2. No minimum length or strength validation is enforced.\n3. After changing the password, previously issued session tokens remain valid.\n4. No forced logout occurs across active sessions.\n\n_Attack scenario:_\n\nAttacker guesses or obtains weak credentials.\nLogs in and obtains active session token.\nVictim changes password.\nAttacker continues accessing the account using the old session.\n\n**Steps to Reproduce**\n\n**1.** Register using a weak password (e.g., 12345678 ).\n**2.** Log in and Password Change functionality.\n**3.** Change account password with single character (e.g., 1 or a )\n**4.** Reuse the old session.\n**5.** Observe that access is still granted.\n\n**Impact**\n\n- Persistent account takeover\n- Unauthorized access to sensitive data\n- Increased brute-force success probability\n- Elevated risk for administrative accounts\n\nThe combination of weak password controls and improper session invalidation significantly increases both exploitability and impact.\n\n**Recommendation**\n_**Password Policy Improvements:**_\n\n- Enforce strong password policies \u2013 Require passwords to be 8\u201316+ characters with a mix of uppercase, lowercase, numbers, and special characters.\n- Block common passwords \u2013 Use a blacklist of commonly used and breached passwords.\n- Use secure hashing \u2013 Store passwords using strong salted hashing algorithms like bcrypt or Argon2.\n- Enable account lockout \u2013 Limit failed login attempts to reduce brute-force risk.\n- Educate users \u2013 Promote strong password practices and phishing awareness.\n\n_**Session Management Fix:**_\n\n- Invalidate all active sessions upon password change\n- Revoke refresh tokens (if applicable)\n- Implement token/session versioning\n- Regenerate session IDs after credential updates\n- Log and notify users of password change events\n\nImplementing both controls will significantly reduce the risk of persistent account compromise.\n\n\u003cimg width=\"1918\" height=\"907\" alt=\"Weak Password Policy Combined with Persistent Sessions After Password Change POC\" src=\"https://github.com/user-attachments/assets/f188b69b-0472-4d2c-aeda-c145384c99ef\" /\u003e\n\nA fixed version is available at https://github.com/go-vikunja/vikunja/releases/tag/v2.0.0.",
  "id": "GHSA-3ccg-x393-96v8",
  "modified": "2026-02-27T21:51:50Z",
  "published": "2026-02-25T22:02:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3ccg-x393-96v8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27575"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/commit/89c17d3b23e2a23320ad135b4e8f0a14fdd91bda"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-vikunja/vikunja"
    },
    {
      "type": "WEB",
      "url": "https://vikunja.io/changelog/vikunja-v2.0.0-was-released"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "yt-dlp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2022.10.04"
            },
            {
              "fixed": "2023.11.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-46121"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444",
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-15T14:48:24Z",
    "nvd_published_at": "2023-11-15T00:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp\u0027s HTTP session. This could lead to cookie exfiltration in some cases.\n\n\u003cdetails\u003e\n\nTo pass extra control data between extractors (such as headers like `Referer`), yt-dlp employs a concept of \"url smuggling\". This works by adding this extra data as json to the url fragment (\"smuggling\") that is then passed on to an extractor. The receiving extractor then \"unsmuggles\" the data from the input url. This functionality is intended to be internal only.\n\nCurrently, the Generic extractor supports receiving an arbitrary dictionary of HTTP headers in a smuggled url, of which it extracts and adds them to the initial request it makes to such url. This is useful when a url sent to the Generic extractor needs a `Referer` header sent with it, for example.\n\nAdditionally, yt-dlp has internal headers to set a proxy for a request: `Ytdl-request-proxy` and `Ytdl-socks-proxy`. While these are deprecated, internally `Ytdl-request-proxy` is still used for `--geo-verification-proxy`.\n\nHowever, it is possible for a maliciously crafted site include these smuggled options in a url which then the Generic extractor extracts and redirects to itself.  This allows a malicious website to **set an arbitrary proxy for an arbitrary url that the Generic extractor will request.**\n\nThis could allow for the following, but not limited too:\n- An attacker can MITM a request it asks yt-dlp to make to **any** website.\n   - If a user has loaded cookies into yt-dlp for the target site, which are not marked as [secure](https://en.wikipedia.org/wiki/Secure_cookie), they could be exfiltrated by the attacker.\n   - Fortunately most sites are HTTPS and should be setting cookies as secure.\n- An attacker can set cookies for an arbitrary site.\n\nAn example malicious webpage:\n```html\n\u003c!DOCTYPE html\u003e\n\u003ccinerama.embedPlayer(\u0027t\u0027,\u0027{{ target_site }}#__youtubedl_smuggle=%7B%22http_headers%22:%7B%22Ytdl-request-proxy%22:%22{{ proxy url }}%22%7D,%22fake%22:%22.smil/manifest%22%7D\u0027)\n```\n\nWhere `{{ target_site }}` is the URL Generic extractor will request and `{{ proxy url }}` is the proxy to proxy the request for this url through.\n\n\u003c/details\u003e\n\n### Patches\n- We have removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern.\n\n### Workarounds\n- Disable Generic extractor (`--ies default,-generic`), or only pass trusted sites with trusted content.\n- Take caution when using `--no-check-certificate`.\n\n### References\n- \u003chttps://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3ch3-jhc6-5r8x\u003e\n- \u003chttps://nvd.nist.gov/vuln/detail/CVE-2023-46121\u003e\n- \u003chttps://github.com/yt-dlp/yt-dlp/releases/tag/2023.11.14\u003e\n- \u003chttps://github.com/yt-dlp/yt-dlp/commit/f04b5bedad7b281bee9814686bba1762bae092eb\u003e\n",
  "id": "GHSA-3ch3-jhc6-5r8x",
  "modified": "2023-11-15T14:48:24Z",
  "published": "2023-11-15T14:48:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3ch3-jhc6-5r8x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46121"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yt-dlp/yt-dlp/commit/f04b5bedad7b281bee9814686bba1762bae092eb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yt-dlp/yt-dlp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yt-dlp/yt-dlp/releases/tag/2023.11.14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-1435"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-18T14:16:05Z",
    "severity": "CRITICAL"
  },
  "details": "Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new \u0027sessionId\u0027 each time a user authenticates, but does not invalidate previously issued session identifiers, which remain valid even after multiple consecutive logins by the same user. As a result, a stolen or leaked \u0027sessionId\u0027 can continue to be used to authenticate valid requests. Exploiting this vulnerability would allow an attacker with access to the web service/API network (port 9000 or HTTP/S endpoint of the server) to reuse an old session token to gain unauthorized access to the application, interact with the API/web, and compromise the integrity of the affected account.",
  "id": "GHSA-3crm-x896-j73p",
  "modified": "2026-02-18T21:31:22Z",
  "published": "2026-02-18T15:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1435"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-graylog"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-45718"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-384",
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-09T22:15:08Z",
    "severity": "LOW"
  },
  "details": "Sametime is impacted by a failure to invalidate sessions.  The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session. \u00a0",
  "id": "GHSA-3f8r-x482-8qpg",
  "modified": "2025-06-03T21:30:34Z",
  "published": "2024-02-10T00:31:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45718"
    },
    {
      "type": "WEB",
      "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0109082"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.graylog2:graylog2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0"
            },
            {
              "fixed": "5.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.graylog2:graylog2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "5.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-41041"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-06T20:47:54Z",
    "nvd_published_at": "2023-08-30T22:15:10Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nIn a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time.\n\n### Details\n\nEach node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the database. After that, the node operates solely on the cached session. Modifications to sessions will update the cached version as well as the session persisted in the database. However, each node maintains their isolated version of the session.\n\nWhen the user logs out, the session is removed from the node-local cache and deleted from the database. The other nodes will however still use the cached session.\n\nThese nodes will only fail to accept the session id if they intent to update the session in the database. They will then notice that the session is gone. This is true for most API requests originating from user interaction with the Graylog UI because these will lead to an update of the session\u0027s \"last access\" timestamp.\n\nIf the session update is however prevented by setting the `X-Graylog-No-Session-Extension:true` header in the request, the node will consider the (cached) session valid until the session is expired according to its timeout setting.\n\n### PoC\nIn a 2-node setup, with both nodes behind a load balancer:\n\n1. Log in\n1. Extract the session ID from the cookie\n1. Log out and close the browser\n1. Perform the following API request repeatedly with curl (with `\u003csession-id\u003e` replaced with the session id from step 2 and `\u003clb-host\u003e` replaced with the hostname of your load balancer):\n    ```\n    curl -I -H X-Graylog-No-Session-Extension:true https://\u003csession-id\u003e:session@\u003clb-host\u003e/api/system/cluster/nodes\n    ```\n1. Notice that the request is sometimes rejected, but sometimes succeeds\n\n\n### Impact\n\nNo session identifiers are leaked.\n\nAfter a user has logged out, the UI shows the login screen again, which gives the user the impression that their session is not valid anymore. However, if the session becomes compromised later, it can still be used to perform API requests against the Graylog cluster. The time frame for this is limited to the configured session lifetime, starting from the time when the user logged out.\n\n\n",
  "id": "GHSA-3fqm-frhg-7c85",
  "modified": "2023-08-31T18:30:20Z",
  "published": "2023-07-06T20:47:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-3fqm-frhg-7c85"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41041"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/bb88f3d0b2b0351669ab32c60b595ab7242a3fe3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Graylog2/graylog2-server/commit/ff90f3e2aa4ae2e0bb613d3236e52c40aa154b20"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Graylog2/graylog2-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Graylog user session is still usable after logout"
}