CVE-2026-12254 is a vulnerability in Netskope Client prior to version R142 involving insufficient session expiration related to captive portals. When a system using Netskope Client connects to a network with a captive portal and then switches to another network with internet access, the captive portal session does not close properly. This flaw could allow an attacker controlling a rogue access point to abuse the captive portal session to access malicious sites or exfiltrate data. The issue is fixed in version R142.
@fastify/oauth2 versions 7.2.0 through 8.3.1 contain a Cross-Site Request Forgery (CSRF) vulnerability due to inconsistent cookie Path attributes for state and code-verifier cookies during OAuth2 login flows. This inconsistency allows the state cookie to persist beyond the OAuth callback, violating the single-use guarantee. An attacker who learns a valid state value can perform login CSRF by forcing the victim's browser to sign into the attacker’s account. The issue is fixed in version 8.3.2.
CVE-2026-79624 is a critical vulnerability in Apache Answer up to version 2.0.2 involving insufficient session expiration. This flaw allows revoked users to continue accessing private uploaded files using stale session tokens. The issue is fixed in version 2.0.3.
@fastify/jwt versions prior to 10.2.5 have a vulnerability where the top-level sign and verify methods do not merge per-call options with global defaults. This causes token expiration and maximum age protections to be silently dropped, resulting in tokens that never expire and verification that does not enforce maximum age. The issue is fixed in version 10.2.5.
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user.
Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
FileRise versions prior to 3.16.0 have an insufficient session expiration vulnerability where the isAdmin flag is stored in remember-me tokens and not updated upon user role changes. This allows a user with a pre-demotion token to retain administrator privileges after their role has been downgraded. The issue is fixed in version 3.16.0.
CVE-2026-89073 is a high-severity vulnerability in Progress MOVEit Transfer involving insufficient session expiration. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability could allow an attacker to maintain access through sessions that do not expire properly, potentially leading to full compromise of confidentiality, integrity, and availability. No known exploits are reported in the wild. The CVSS score is 7.5, indicating a significant risk that requires attention.
CVE-2026-84321 is a medium severity vulnerability in 0xJacky's nginx-ui prior to version 2.4.1 involving insufficient session expiration. Standalone short tokens used for WebSocket and explicit-token authentication remain valid in cache even after administrative revocation. If the associated user account is re-enabled before the cache entry expires, the stale short token can be reused to authenticate successfully.
CVE-2026-78357 is a critical vulnerability in OTRS software where previously issued authentication tokens (JWTs) are not invalidated immediately after a user account is deactivated or its password is changed. This allows an attacker with a previously obtained valid token to continue accessing the system with the privileges of the affected user until the token expires, which can be about 16 hours. The impact depends on the permissions of the compromised token, with agent tokens potentially granting broad access. The vulnerability affects multiple OTRS versions prior to 2026.7.X.
CVE-2026-71575 is a critical vulnerability in Apache CXF affecting the OidcClientCodeRequestFilter component. Due to a milliseconds/seconds unit mismatch and inverted comparison polarity, the max_age authentication freshness check was ineffective. This flaw allows relying parties using setMaxAgeOffset to enforce re-authentication to bypass step-up authentication policies, accepting sessions of any age. The issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf comparisons always pass, allowing expired or not-yet-active tokens to be accepted. The verifier cache also derives infinite bounds, so entries created under this configuration can remain valid until eviction. Exploitation requires an application administrator or equivalent configuration path to set clockTolerance to Infinity. This issue is fixed in version 6.3.0.
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadline only when iat is present, so the cache falls back to cacheTTL, and a later cache hit returns the saved payload before verifyToken rechecks expiration. An attacker who can replay the same cached bearer token can extend access until the cache entry expires, but cannot forge a token through this issue. This issue is fixed in version 6.3.4.
The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the OTP.
The absence of automatic expiration for OTPs grants attackers an unlimited timeframe to attempt guessing the correct code. A successful brute force attack can lead to an MFA bypass, resulting in the unauthorized takeover of a user's account and compromising the security and privacy of both the individual and the system.
wger versions prior to 2.6 contain an improper authentication vulnerability where bearer-style API tokens remain valid after user logout or password change. This allows an attacker with a stolen token to continue accessing protected API endpoints until the token expires or is manually revoked. Version 2.6 includes a patch to address this issue.
When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected.
CVE-2026-97212 is a vulnerability in Monta's monta.app where the WebSocket backend uses predictable session identifiers by allowing multiple endpoints to connect using the same charging station identifier. This flaw can enable unauthorized users to impersonate others or cause denial-of-service by flooding the backend with valid session requests. The vulnerability has a high severity rating with a CVSS score of 7.3.
iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of the victim.
CVE-2026-88805 is a high-severity vulnerability in SUSE Rancher versions 2.15.0 and 2.15.1 where insufficient session expiration occurs due to incorrect credential cleaning on logout. This flaw allows remote attackers to retain access credentials even after the user logs out, potentially leading to unauthorized access. The issue is fixed starting from version 2.15.2.
CVE-2026-67242 is a medium severity vulnerability in rabbitmq-server affecting versions from 4.2.0 up to but not including 4.2.9 and from 4.3.0 up to but not including 4.3.3. The issue arises because the OAuth2 token expiry validation incorrectly skips checks when the token's 'exp' claim is a floating-point number rather than an integer. This allows an attacker with a previously valid signed token containing a float 'exp' value to bypass expiry checks, causing the server to accept expired tokens and maintain connections indefinitely. The vulnerability is fixed in versions 4.2.9 and 4.3.3.
The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing client while previously established session state remains active until a separate expiration mechanism invalidates it. An unauthenticated attacker with adjacent network access could potentially take advantage of this residual authentication state to access functionality associated with another client's session.