Common Weakness Enumeration
CWE-613
Allowed-with-ReviewInsufficient Session Expiration
Abstraction: Base · Status: Incomplete
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
980 vulnerabilities reference this CWE, most recent first.
GHSA-R4R6-J2J3-7PP5
Vulnerability from github – Published: 2024-04-09 16:15 – Updated: 2024-04-09 21:12
VLAI
Summary
Contao: Remember-me tokens will not be cleared after a password change
Details
Impact
When a front end member changes their password, the corresponding remember-me tokens are not removed.
Patches
Update to Contao 4.13.40.
Workarounds
Disable "Allow auto login" in the login module.
References
https://contao.org/en/security-advisories/remember-me-tokens-are-not-cleared-after-a-password-change
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "contao/core-bundle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.13.40"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-30262"
],
"database_specific": {
"cwe_ids": [
"CWE-384",
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-09T16:15:06Z",
"nvd_published_at": "2024-04-09T17:16:02Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nWhen a front end member changes their password, the corresponding remember-me tokens are not removed.\n\n### Patches\n\nUpdate to Contao 4.13.40.\n\n### Workarounds\n\nDisable \"Allow auto login\" in the login module.\n\n### References\n\nhttps://contao.org/en/security-advisories/remember-me-tokens-are-not-cleared-after-a-password-change\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).",
"id": "GHSA-r4r6-j2j3-7pp5",
"modified": "2024-04-09T21:12:19Z",
"published": "2024-04-09T16:15:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30262"
},
{
"type": "WEB",
"url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"
},
{
"type": "WEB",
"url": "https://contao.org/en/security-advisories/remember-me-tokens-are-not-cleared-after-a-password-change"
},
{
"type": "PACKAGE",
"url": "https://github.com/contao/contao"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Contao: Remember-me tokens will not be cleared after a password change"
}
GHSA-R568-9M64-GFRV
Vulnerability from github – Published: 2022-05-24 17:10 – Updated: 2024-04-04 02:48
VLAI
Details
SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2020-6178"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-10T21:15:00Z",
"severity": "MODERATE"
},
"details": "SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure.",
"id": "GHSA-r568-9m64-gfrv",
"modified": "2024-04-04T02:48:58Z",
"published": "2022-05-24T17:10:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6178"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2880664"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R5HH-FV95-JJXP
Vulnerability from github – Published: 2024-02-09 03:33 – Updated: 2024-02-09 03:33
VLAI
Details
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 268749.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-45187"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-09T01:15:08Z",
"severity": "MODERATE"
},
"details": "IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 268749.",
"id": "GHSA-r5hh-fv95-jjxp",
"modified": "2024-02-09T03:33:10Z",
"published": "2024-02-09T03:33:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45187"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/268749"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7116045"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-R67G-69PQ-W76X
Vulnerability from github – Published: 2024-08-13 03:31 – Updated: 2024-08-13 03:31
VLAI
Details
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another user to obtain sensitive information. IBM X-Force ID: 233672.
Severity
4.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-38382"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T02:15:04Z",
"severity": "MODERATE"
},
"details": "IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another user to obtain sensitive information. IBM X-Force ID: 233672.",
"id": "GHSA-r67g-69pq-w76x",
"modified": "2024-08-13T03:31:16Z",
"published": "2024-08-13T03:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38382"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233672"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7165286"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R6PV-X5P3-8FV6
Vulnerability from github – Published: 2026-09-16 21:32 – Updated: 2026-09-16 21:32
VLAI
Details
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-92800"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T21:17:29Z",
"severity": "HIGH"
},
"details": "Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.",
"id": "GHSA-r6pv-x5p3-8fv6",
"modified": "2026-09-16T21:32:56Z",
"published": "2026-09-16T21:32:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92800"
},
{
"type": "WEB",
"url": "https://github.com/suitenumerique/docs/commit/d35b81a6ed526dc284c8d0f68b762f2e81ffab13"
},
{
"type": "WEB",
"url": "https://github.com/geo-chen/oss/blob/main/docs.md"
},
{
"type": "WEB",
"url": "https://github.com/suitenumerique/docs"
},
{
"type": "WEB",
"url": "https://github.com/suitenumerique/docs/blob/v5.3.0/src/backend/core/api/viewsets.py#L2825-L2860"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/docs-before-5.4.1-stale-collaboration-session-after-access-revocation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-R6XP-85FR-87P6
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19
VLAI
Details
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges.
{
"affected": [],
"aliases": [
"CVE-2021-40849"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-03T11:15:00Z",
"severity": "CRITICAL"
},
"details": "In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges.",
"id": "GHSA-r6xp-85fr-87p6",
"modified": "2022-05-24T19:19:35Z",
"published": "2022-05-24T19:19:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40849"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/mahara/+bug/1930469"
},
{
"type": "WEB",
"url": "https://mahara.org/interaction/forum/topic.php?id=8949"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-R76W-3WWQ-JV6V
Vulnerability from github – Published: 2023-03-07 00:30 – Updated: 2024-10-21 19:57
VLAI
Summary
Insufficient Session Expiration in pretix
Details
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pretix"
},
"ranges": [
{
"events": [
{
"introduced": "4.17.0"
},
{
"fixed": "4.17.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pretix"
},
"ranges": [
{
"events": [
{
"introduced": "4.16.0"
},
{
"fixed": "4.16.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pretix"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.15.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-27891"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-14T23:01:26Z",
"nvd_published_at": "2023-03-06T23:15:00Z",
"severity": "HIGH"
},
"details": "rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.",
"id": "GHSA-r76w-3wwq-jv6v",
"modified": "2024-10-21T19:57:52Z",
"published": "2023-03-07T00:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27891"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2023-42.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/thufschmitt/pretix-nix"
},
{
"type": "WEB",
"url": "https://pretix.eu/about/en/blog/20230306-release-4171"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Insufficient Session Expiration in pretix"
}
GHSA-R7CM-W9CH-CF3G
Vulnerability from github – Published: 2026-06-15 12:32 – Updated: 2026-08-20 18:30
VLAI
Details
A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth (Open Authorization) access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backend, leaving it valid until its natural expiration. This can lead to unauthorized read access to Ansible resources such as inventories, playbooks, and configuration data.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-44188"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T10:16:28Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth (Open Authorization) access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backend, leaving it valid until its natural expiration. This can lead to unauthorized read access to Ansible resources such as inventories, playbooks, and configuration data.",
"id": "GHSA-r7cm-w9ch-cf3g",
"modified": "2026-08-20T18:30:32Z",
"published": "2026-06-15T12:32:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44188"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25928"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34374"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-44188"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466764"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R8PM-G6V2-5WGX
Vulnerability from github – Published: 2022-05-24 19:17 – Updated: 2022-05-24 19:17
VLAI
Details
The vulnerability can be described as a failure to invalidate user session upon password change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session.
{
"affected": [],
"aliases": [
"CVE-2021-35214"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-12T16:15:00Z",
"severity": "MODERATE"
},
"details": "The vulnerability can be described as a failure to invalidate user session upon password change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session.",
"id": "GHSA-r8pm-g6v2-5wgx",
"modified": "2022-05-24T19:17:18Z",
"published": "2022-05-24T19:17:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35214"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35214"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-R926-QJG2-Q5JR
Vulnerability from github – Published: 2023-12-14 06:30 – Updated: 2025-11-04 21:30
VLAI
Details
An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-49935"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-14T05:15:10Z",
"severity": "HIGH"
},
"details": "An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.",
"id": "GHSA-r926-qjg2-q5jr",
"modified": "2025-11-04T21:30:52Z",
"published": "2023-12-14T06:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49935"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO"
},
{
"type": "WEB",
"url": "https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html"
},
{
"type": "WEB",
"url": "https://www.schedmd.com/security-archive.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
Set sessions/credentials expiration date.
No CAPEC attack patterns related to this CWE.