Skip to content
Log inStart free trial

CWE-613: Insufficient Session Expiration

Base

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Consequences

  • Access Control: Bypass Protection Mechanism

How to prevent it

  • Implementation: Set sessions/credentials expiration date.

Recent advisories

  • GHSA-r7rc-c989-86g6 — Keycloak: Attacker can re-enable and take over disabled clients via registration access token
  • GHSA-wq4w-vwvq-q3x9 — Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
  • GHSA-hjx8-qv73-f7cm — Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
  • GHSA-4hv6-xc92-j86g — Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
  • GHSA-jq7h-wrvp-3rgx — pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
  • GHSA-889w-m37p-88m5 — pyLoad: Api.set_user_permission never invalidates the target's session
  • PYSEC-2026-3990 — Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie.
  • EEF-CVE-2026-86533 — Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
  • EEF-CVE-2026-81637 — Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication
  • GHSA-wjwr-xfp9-r66p — Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
  • GHSA-rgv6-xp99-6mgj — Gitea Remember-Me Token Theft Not Invalidating Attacker Session
  • GHSA-v77h-2w3m-94hx — ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
  • GHSA-855v-hq7w-jmjw — Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
  • GHSA-2vg6-77g8-24mp — Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
  • GHSA-392p-2q2v-4372 — Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

All advisories for CWE-613

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor