CWE-613
Allowed-with-ReviewInsufficient Session Expiration
Abstraction: Base · Status: Incomplete
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
977 vulnerabilities reference this CWE, most recent first.
GHSA-JJX8-FGCM-MHJX
Vulnerability from github – Published: 2024-10-07 18:31 – Updated: 2024-11-05 00:31IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode leads the attacker to replay the Wi-Fi packets and forcefully turn off the access point after the authentication token has expired.
{
"affected": [],
"aliases": [
"CVE-2024-46040"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-07T16:15:05Z",
"severity": "MODERATE"
},
"details": "IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode leads the attacker to replay the Wi-Fi packets and forcefully turn off the access point after the authentication token has expired.",
"id": "GHSA-jjx8-fgcm-mhjx",
"modified": "2024-11-05T00:31:27Z",
"published": "2024-10-07T18:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46040"
},
{
"type": "WEB",
"url": "https://github.com/Anonymous120386/Anonymous"
},
{
"type": "WEB",
"url": "https://www.iothaat.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JM72-67RM-763J
Vulnerability from github – Published: 2022-04-21 01:54 – Updated: 2025-06-09 17:48An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.24.4"
},
"package": {
"ecosystem": "Packagist",
"name": "mantisbt/mantisbt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.24.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2009-20001"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T23:02:24Z",
"nvd_published_at": "2021-03-07T20:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user\u0027s cookie to login as them.",
"id": "GHSA-jm72-67rm-763j",
"modified": "2025-06-09T17:48:33Z",
"published": "2022-04-21T01:54:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-20001"
},
{
"type": "WEB",
"url": "https://github.com/mantisbt/mantisbt/commit/79a78c09d5ef5ce098adc73f6f1416f00fc238a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/mantisbt/mantisbt"
},
{
"type": "WEB",
"url": "https://mantisbt.org/bugs/view.php?id=11296"
},
{
"type": "WEB",
"url": "https://mantisbt.org/bugs/view.php?id=27976"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "MantisBT Insufficient Session Expiration cookie string not reset after logout"
}
GHSA-JP3H-X882-5CRH
Vulnerability from github – Published: 2022-07-13 00:01 – Updated: 2022-07-16 00:00A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions.
{
"affected": [],
"aliases": [
"CVE-2022-33137"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-12T10:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in SIMATIC MV540 H (All versions \u003c V3.3), SIMATIC MV540 S (All versions \u003c V3.3), SIMATIC MV550 H (All versions \u003c V3.3), SIMATIC MV550 S (All versions \u003c V3.3), SIMATIC MV560 U (All versions \u003c V3.3), SIMATIC MV560 X (All versions \u003c V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users\u0027 sessions.",
"id": "GHSA-jp3h-x882-5crh",
"modified": "2022-07-16T00:00:23Z",
"published": "2022-07-13T00:01:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33137"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-348662.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JP9R-HWVP-X6C8
Vulnerability from github – Published: 2026-03-02 03:30 – Updated: 2026-03-02 03:30A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipulation causes session expiration. Remote exploitation of the attack is possible. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks.
{
"affected": [],
"aliases": [
"CVE-2026-3401"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-02T01:16:02Z",
"severity": "LOW"
},
"details": "A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipulation causes session expiration. Remote exploitation of the attack is possible. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks.",
"id": "GHSA-jp9r-hwvp-x6c8",
"modified": "2026-03-02T03:30:20Z",
"published": "2026-03-02T03:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3401"
},
{
"type": "WEB",
"url": "https://github.com/hiranerakkot/Web-based-Pharmacy-Product-Management-System/blob/main/README.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.348296"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.348296"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.762795"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JRVX-J527-53GX
Vulnerability from github – Published: 2022-05-13 01:37 – Updated: 2022-05-13 01:37An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The user's session is available for an extended period beyond the last activity, allowing an attacker to reuse an old session for authorization.
{
"affected": [],
"aliases": [
"CVE-2017-14007"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-17T22:29:00Z",
"severity": "MODERATE"
},
"details": "An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The user\u0027s session is available for an extended period beyond the last activity, allowing an attacker to reuse an old session for authorization.",
"id": "GHSA-jrvx-j527-53gx",
"modified": "2022-05-13T01:37:41Z",
"published": "2022-05-13T01:37:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14007"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-285-01"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101259"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-JVMC-9QMP-G6PW
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
{
"affected": [],
"aliases": [
"CVE-2020-27422"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-16T16:15:00Z",
"severity": "CRITICAL"
},
"details": "In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn\u0027t expire once used, allowing an attacker to use the same link to takeover the account.",
"id": "GHSA-jvmc-9qmp-g6pw",
"modified": "2022-05-24T17:34:17Z",
"published": "2022-05-24T17:34:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27422"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html"
},
{
"type": "WEB",
"url": "https://www.anuko.com/time-tracker/index.htm"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JWGW-M7R5-WR43
Vulnerability from github – Published: 2021-12-01 00:00 – Updated: 2021-12-03 00:00Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to reuse old session artifacts to impersonate a legitimate user.
{
"affected": [],
"aliases": [
"CVE-2021-36330"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-30T21:15:00Z",
"severity": "CRITICAL"
},
"details": "Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to reuse old session artifacts to impersonate a legitimate user.",
"id": "GHSA-jwgw-m7r5-wr43",
"modified": "2021-12-03T00:00:56Z",
"published": "2021-12-01T00:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36330"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-in/000193697/dsa-2021-205-dell-emc-streaming-data-platform-security-update-for-third-party-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JWR6-J6QM-W9JV
Vulnerability from github – Published: 2024-03-26 15:30 – Updated: 2024-08-05 21:31xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.
{
"affected": [],
"aliases": [
"CVE-2024-29401"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-26T15:15:49Z",
"severity": "CRITICAL"
},
"details": "xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.",
"id": "GHSA-jwr6-j6qm-w9jv",
"modified": "2024-08-05T21:31:19Z",
"published": "2024-03-26T15:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29401"
},
{
"type": "WEB",
"url": "https://github.com/menghaining/PoC/blob/main/xzs-mysql/xzs-mysql%20--%20PoC.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M2WF-77JJ-CHRW
Vulnerability from github – Published: 2025-07-28 21:31 – Updated: 2025-07-28 21:31Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack.
{
"affected": [],
"aliases": [
"CVE-2025-50484"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-28T19:15:42Z",
"severity": "HIGH"
},
"details": "Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack.",
"id": "GHSA-m2wf-77jj-chrw",
"modified": "2025-07-28T21:31:33Z",
"published": "2025-07-28T21:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50484"
},
{
"type": "WEB",
"url": "https://github.com/VasilVK/CVE/tree/main/CVE-2025-50484"
},
{
"type": "WEB",
"url": "http://phpgurukul.com"
},
{
"type": "WEB",
"url": "http://small.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M3GQ-F9RC-QMWX
Vulnerability from github – Published: 2024-03-06 00:31 – Updated: 2024-11-01 18:31Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365.
The user will stay authenticated until the Devolutions Server token expiration.
{
"affected": [],
"aliases": [
"CVE-2024-1900"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-05T22:15:47Z",
"severity": "MODERATE"
},
"details": "Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. \n\nThe user will stay authenticated until the Devolutions Server token expiration.",
"id": "GHSA-m3gq-f9rc-qmwx",
"modified": "2024-11-01T18:31:25Z",
"published": "2024-03-06T00:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1900"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2024-0002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Set sessions/credentials expiration date.
No CAPEC attack patterns related to this CWE.