Common Weakness Enumeration

CWE-613

Allowed-with-Review

Insufficient Session Expiration

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

876 vulnerabilities reference this CWE, most recent first.

GHSA-CFMG-G9HG-M3G2

Vulnerability from github – Published: 2022-05-13 01:38 – Updated: 2022-05-13 01:38
VLAI
Details

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.

Severity
7.4 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-12191"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-02-28T13:29:00Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.",
  "id": "GHSA-cfmg-g9hg-m3g2",
  "modified": "2022-05-13T01:38:11Z",
  "published": "2022-05-13T01:38:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12191"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:0374"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2017-12191"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1500517"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CH64-2V27-7PWP

Vulnerability from github – Published: 2022-05-13 01:05 – Updated: 2022-05-13 01:05
VLAI
Details

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2014-3616"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-12-08T11:59:00Z",
    "severity": "MODERATE"
  },
  "details": "nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct \"virtual host confusion\" attacks.",
  "id": "GHSA-ch64-2v27-7pwp",
  "modified": "2022-05-13T01:05:17Z",
  "published": "2022-05-13T01:05:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3616"
    },
    {
      "type": "WEB",
      "url": "http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2014/dsa-3029"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-CH77-2Q3C-8F9W

Vulnerability from github – Published: 2026-01-07 12:31 – Updated: 2026-01-07 12:31
VLAI
Details

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

Severity
2.0 (Low)
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-31962"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-07T12:17:01Z",
    "severity": "LOW"
  },
  "details": "Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.",
  "id": "GHSA-ch77-2q3c-8f9w",
  "modified": "2026-01-07T12:31:23Z",
  "published": "2026-01-07T12:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31962"
    },
    {
      "type": "WEB",
      "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0127753"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CH7Q-53V8-73PC

Vulnerability from github – Published: 2025-11-19 18:47 – Updated: 2025-11-19 18:47
VLAI
Summary
authentik's invitation expiry is delayed by at least 5 minutes
Details

Summary

In previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes. However, with a large amount of tasks in the backlog, this might take longer.

Patches

authentik 2025.8.5 and 2025.10.2 fix this issue; for other versions the workaround below can be used.

Workarounds

Users can create a policy that explicitly checks whether the invitation is still valid, and then bind it to the invitation stage on your invitation flow, and deny access if the invitation is not valid.

return not context['flow_plan'].context['invitation'].is_expired

For more information

If users have any questions or comments about this advisory:

Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "goauthentik.io"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20251119135424-6672e6aaa41e"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-64708"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-19T18:47:07Z",
    "nvd_published_at": "2025-11-19T17:15:52Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nIn previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes. However, with a large amount of tasks in the backlog, this might take longer.\n\n### Patches\n\nauthentik 2025.8.5 and 2025.10.2 fix this issue; for other versions the workaround below can be used.\n\n### Workarounds\n\nUsers can create a policy that explicitly checks whether the invitation is still valid, and then bind it to the invitation stage on your invitation flow, and deny access if the invitation is not valid.\n\n```python\nreturn not context[\u0027flow_plan\u0027].context[\u0027invitation\u0027].is_expired\n```\n\n### For more information\n\nIf users have any questions or comments about this advisory:\n\n- Email the authentik team at [security@goauthentik.io](mailto:security@goauthentik.io).",
  "id": "GHSA-ch7q-53v8-73pc",
  "modified": "2025-11-19T18:47:08Z",
  "published": "2025-11-19T18:47:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-ch7q-53v8-73pc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64708"
    },
    {
      "type": "WEB",
      "url": "https://github.com/goauthentik/authentik/commit/6672e6aaa41e0f2c9bfb1e4d8b51cf114969e830"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/goauthentik/authentik"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "authentik\u0027s invitation expiry is delayed by at least 5 minutes"
}

GHSA-CHJ4-WRC6-847J

Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2025-12-09 18:30
VLAI
Details

An insufficient session expiration vulnerability [CWE-613] in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control

Severity
5.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-62631"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-09T18:16:03Z",
    "severity": "MODERATE"
  },
  "details": "An insufficient session expiration vulnerability [CWE-613] in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user\u0027s password change under particular conditions outside of the attacker\u0027s control",
  "id": "GHSA-chj4-wrc6-847j",
  "modified": "2025-12-09T18:30:47Z",
  "published": "2025-12-09T18:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62631"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-411"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CHXC-45G7-VR66

Vulnerability from github – Published: 2025-02-18 21:32 – Updated: 2025-02-19 00:31
VLAI
Details

Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could be used by a malicious attacker to impersonate an existing user session.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-57056"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-18T19:15:20Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could be used by a malicious attacker to impersonate an existing user session.",
  "id": "GHSA-chxc-45g7-vr66",
  "modified": "2025-02-19T00:31:16Z",
  "published": "2025-02-18T21:32:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57056"
    },
    {
      "type": "WEB",
      "url": "https://www.wombatdialer.com/blog/blog/2025/02/18/CVE"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CM29-6WX7-P874

Vulnerability from github – Published: 2022-04-03 00:01 – Updated: 2023-07-11 23:38
VLAI
Summary
Keycloak insufficient session expiration
Details

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].

Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.keycloak:keycloak-parent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-3461"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-11T23:38:35Z",
    "nvd_published_at": "2022-04-01T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].",
  "id": "GHSA-cm29-6wx7-p874",
  "modified": "2023-07-11T23:38:35Z",
  "published": "2022-04-03T00:01:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3461"
    },
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak/issues/11203"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1941565"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Keycloak insufficient session expiration"
}

GHSA-CMMR-M3V6-29R4

Vulnerability from github – Published: 2026-02-27 03:30 – Updated: 2026-03-05 21:30
VLAI
Details

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-27647"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-27T01:16:20Z",
    "severity": "HIGH"
  },
  "details": "The WebSocket backend uses charging station identifiers to uniquely \nassociate sessions but allows multiple endpoints to connect using the \nsame session identifier. This implementation results in predictable \nsession identifiers and enables session hijacking or shadowing, where \nthe most recent connection displaces the legitimate charging station and\n receives backend commands intended for that station. This vulnerability\n may allow unauthorized users to authenticate as other users or enable a\n malicious actor to cause a denial-of-service condition by overwhelming \nthe backend with valid session requests.",
  "id": "GHSA-cmmr-m3v6-29r4",
  "modified": "2026-03-05T21:30:28Z",
  "published": "2026-02-27T03:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27647"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-08.json"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-08"
    },
    {
      "type": "WEB",
      "url": "https://www.mobility46.se/en/contact-us"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-CPQ7-Q5W3-H8C8

Vulnerability from github – Published: 2022-06-15 00:00 – Updated: 2022-06-29 00:00
VLAI
Details

** DISPUTED ** A vulnerability has been found in Microsoft O365 and classified as critical. The session cookies introduce a session expiration issue as they might be used by two clients at the same time. The attack can be initiated remotely. Exploit details have been disclosed to the public. The real-world consequences of this vulnerability are still doubted at the moment. It is recommended to change the configuration settings. NOTE: Vendor claims that pre-requisites are very high, the feature works as intended, and that configuration settings might mitigate the issue.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-2076"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-14T08:15:00Z",
    "severity": "HIGH"
  },
  "details": "** DISPUTED ** A vulnerability has been found in Microsoft O365 and classified as critical. The session cookies introduce a session expiration issue as they might be used by two clients at the same time. The attack can be initiated remotely. Exploit details have been disclosed to the public. The real-world consequences of this vulnerability are still doubted at the moment. It is recommended to change the configuration settings. NOTE: Vendor claims that pre-requisites are very high, the feature works as intended, and that configuration settings might mitigate the issue.",
  "id": "GHSA-cpq7-q5w3-h8c8",
  "modified": "2022-06-29T00:00:28Z",
  "published": "2022-06-15T00:00:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2076"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sixgroup-security/Advisories/tree/main/20211209_Missing-Session-Hijacking-Protection-in-Microsoft-O365"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.192028"
    },
    {
      "type": "WEB",
      "url": "https://www.mandiant.com/resources/russian-targeting-gov-business"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CQ9C-6W48-QMFG

Vulnerability from github – Published: 2026-06-22 23:19 – Updated: 2026-06-22 23:19
VLAI
Summary
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
Details

Summary

In OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity. Existing Actual session tokens for the disabled user remain valid, so the user can continue calling authenticated server endpoints after an administrator has disabled the account.

Details

The disabled-user check is present during OpenID login finalization. Existing users are only accepted when the matching row has enabled = 1, and a disabled row causes the OpenID grant to fail before a new session token is created.

// packages/sync-server/src/accounts/openid.ts:284-291
const { id: userIdFromDb, display_name: displayName } =
  accountDb.first(
    'SELECT id, display_name FROM users WHERE user_name = ? and enabled = 1',
    [identity],
  ) || {};

if (userIdFromDb == null) {
  throw new Error('openid-grant-failed');
}

The shared session validation path does not perform the same enabled-user check. It accepts any existing token row that has not expired, then returns the session object to every route protected by validateSessionMiddleware.

// packages/sync-server/src/util/validate-user.ts:10-41
export function validateSession(req: Request, res: Response) {
  let { token } = req.body || {};
  if (!token) {
    token = req.headers['x-actual-token'];
  }

  const session = getSession(token);
  ...
  return session;
}

This means account disablement and session authorization diverge:

OpenID login path: users.enabled must be 1
Existing session path: token exists and is not expired; users.enabled is not checked

The default token expiration setting is never, so this is not just a short race after disablement on default deployments.

// packages/sync-server/src/load-config.js:260-264
token_expiration: {
  doc: 'Token expiration time.',
  format: 'tokenExpiration',
  default: 'never',
  env: 'ACTUAL_TOKEN_EXPIRATION',
},

Admins can change a user's enabled state through the user update route, but that update does not delete the user's existing sessions. After the update, the old token still satisfies validateSession.

// packages/sync-server/src/app-admin.js:91-101
app.patch('/users', validateSessionMiddleware, async (req, res) => {
  if (!isAdmin(res.locals.user_id)) {
    ...
  }

  const { id, userName, role, displayName, enabled } = req.body || {};

// packages/sync-server/src/services/user-service.ts:98-102
getAccountDb().mutate(
  'UPDATE users SET user_name = ?, display_name = ?, enabled = ?, role = ? WHERE id = ?',
  [userName, displayName, enabled, roleId, userId],
);

Authenticated server features then continue to trust that session. For example, the sync API installs validateSessionMiddleware for the whole router, so a disabled user can keep using any sync operation that their still-valid session and existing file ownership/access allow.

// packages/sync-server/src/app-sync.ts:37-39
const app = express();
app.use(validateSessionMiddleware);
app.use(errorMiddleware);

This is distinct from the previously published cross-user sync authorization issue: the attacker does not need to access another user's file ID. The bypass is that a disabled user's own session remains authorized after account disablement.

PoC

  1. Run an Actual Sync Server in OpenID multi-user mode with @actual-app/sync-server 26.5.0. Use the default token expiration setting, or any setting where the token has not expired yet.
  2. Log in as a non-admin OpenID user and save the returned Actual session token.
  3. As an admin, disable that same user through PATCH /admin/users by sending enabled: false.
  4. Reuse the old token against a protected endpoint.

Example success check:

curl -s https://actual.example.com/account/validate \
  -H 'X-Actual-Token: <disabled_user_existing_token>'

Expected result on the affected code path: the request is still treated as authenticated and returns the disabled user's account/session information instead of 401 or 403.

A sync-facing check uses the same session validation primitive:

curl -s https://actual.example.com/sync/list-user-files \
  -H 'X-Actual-Token: <disabled_user_existing_token>'

Expected result on the affected code path: the disabled user can still list and operate on budget files that the stale session is otherwise allowed to access.

Impact

A disabled OpenID user can keep post-authentication access until the session row is deleted or expires. With the default token_expiration: never, this can persist indefinitely.

For a disabled basic user, the confirmed impact is continued access to that user's own budgets and any budgets shared with that user, including sensitive financial data and allowed mutations. For a disabled admin user, the impact is broader because the existing token can still satisfy admin role checks; that condition preserves administrative access after the account was disabled.

The missing rule is that session validation should reject disabled users, and disabling or deleting a user should revoke that user's existing sessions.

Severity
8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 26.5.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@actual-app/sync-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49229"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-22T23:19:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nIn OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity. Existing Actual session tokens for the disabled user remain valid, so the user can continue calling authenticated server endpoints after an administrator has disabled the account.\n\n### Details\n\nThe disabled-user check is present during OpenID login finalization. Existing users are only accepted when the matching row has `enabled = 1`, and a disabled row causes the OpenID grant to fail before a new session token is created.\n\n```ts\n// packages/sync-server/src/accounts/openid.ts:284-291\nconst { id: userIdFromDb, display_name: displayName } =\n  accountDb.first(\n    \u0027SELECT id, display_name FROM users WHERE user_name = ? and enabled = 1\u0027,\n    [identity],\n  ) || {};\n\nif (userIdFromDb == null) {\n  throw new Error(\u0027openid-grant-failed\u0027);\n}\n```\n\nThe shared session validation path does not perform the same enabled-user check. It accepts any existing token row that has not expired, then returns the session object to every route protected by `validateSessionMiddleware`.\n\n```ts\n// packages/sync-server/src/util/validate-user.ts:10-41\nexport function validateSession(req: Request, res: Response) {\n  let { token } = req.body || {};\n  if (!token) {\n    token = req.headers[\u0027x-actual-token\u0027];\n  }\n\n  const session = getSession(token);\n  ...\n  return session;\n}\n```\n\nThis means account disablement and session authorization diverge:\n\n```text\nOpenID login path: users.enabled must be 1\nExisting session path: token exists and is not expired; users.enabled is not checked\n```\n\nThe default token expiration setting is `never`, so this is not just a short race after disablement on default deployments.\n\n```js\n// packages/sync-server/src/load-config.js:260-264\ntoken_expiration: {\n  doc: \u0027Token expiration time.\u0027,\n  format: \u0027tokenExpiration\u0027,\n  default: \u0027never\u0027,\n  env: \u0027ACTUAL_TOKEN_EXPIRATION\u0027,\n},\n```\n\nAdmins can change a user\u0027s enabled state through the user update route, but that update does not delete the user\u0027s existing sessions. After the update, the old token still satisfies `validateSession`.\n\n```js\n// packages/sync-server/src/app-admin.js:91-101\napp.patch(\u0027/users\u0027, validateSessionMiddleware, async (req, res) =\u003e {\n  if (!isAdmin(res.locals.user_id)) {\n    ...\n  }\n\n  const { id, userName, role, displayName, enabled } = req.body || {};\n```\n\n```ts\n// packages/sync-server/src/services/user-service.ts:98-102\ngetAccountDb().mutate(\n  \u0027UPDATE users SET user_name = ?, display_name = ?, enabled = ?, role = ? WHERE id = ?\u0027,\n  [userName, displayName, enabled, roleId, userId],\n);\n```\n\nAuthenticated server features then continue to trust that session. For example, the sync API installs `validateSessionMiddleware` for the whole router, so a disabled user can keep using any sync operation that their still-valid session and existing file ownership/access allow.\n\n```ts\n// packages/sync-server/src/app-sync.ts:37-39\nconst app = express();\napp.use(validateSessionMiddleware);\napp.use(errorMiddleware);\n```\n\nThis is distinct from the previously published cross-user sync authorization issue: the attacker does not need to access another user\u0027s file ID. The bypass is that a disabled user\u0027s own session remains authorized after account disablement.\n\n### PoC\n\n1. Run an Actual Sync Server in OpenID multi-user mode with `@actual-app/sync-server` 26.5.0. Use the default token expiration setting, or any setting where the token has not expired yet.\n2. Log in as a non-admin OpenID user and save the returned Actual session token.\n3. As an admin, disable that same user through `PATCH /admin/users` by sending `enabled: false`.\n4. Reuse the old token against a protected endpoint.\n\nExample success check:\n\n```bash\ncurl -s https://actual.example.com/account/validate \\\n  -H \u0027X-Actual-Token: \u003cdisabled_user_existing_token\u003e\u0027\n```\n\nExpected result on the affected code path: the request is still treated as authenticated and returns the disabled user\u0027s account/session information instead of `401` or `403`.\n\nA sync-facing check uses the same session validation primitive:\n\n```bash\ncurl -s https://actual.example.com/sync/list-user-files \\\n  -H \u0027X-Actual-Token: \u003cdisabled_user_existing_token\u003e\u0027\n```\n\nExpected result on the affected code path: the disabled user can still list and operate on budget files that the stale session is otherwise allowed to access.\n\n### Impact\n\nA disabled OpenID user can keep post-authentication access until the session row is deleted or expires. With the default `token_expiration: never`, this can persist indefinitely.\n\nFor a disabled basic user, the confirmed impact is continued access to that user\u0027s own budgets and any budgets shared with that user, including sensitive financial data and allowed mutations. For a disabled admin user, the impact is broader because the existing token can still satisfy admin role checks; that condition preserves administrative access after the account was disabled.\n\nThe missing rule is that session validation should reject disabled users, and disabling or deleting a user should revoke that user\u0027s existing sessions.",
  "id": "GHSA-cq9c-6w48-qmfg",
  "modified": "2026-06-22T23:19:56Z",
  "published": "2026-06-22T23:19:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/actualbudget/actual/security/advisories/GHSA-cq9c-6w48-qmfg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/actualbudget/actual"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens"
}
Mitigation
Implementation

Set sessions/credentials expiration date.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list