The Norwegian Cruise Line door access control system uses only the static 7-byte UID from an NTAG212 NFC chip to grant entry. This UID is a manufacturer serial number transmitted in clear text and is not designed to authenticate the holder. The system's reliance on this UID alone constitutes identification rather than proper authentication, lacking challenge-response mechanisms to prevent cloning or unauthorized access.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an insufficient session expiration vulnerability. This flaw allows a low privileged attacker with adjacent network access to potentially elevate privileges, bypass protection mechanisms, and gain unauthorized access. The vulnerability is identified as CWE-613. The CVSS 3.1 base score is 6.4, indicating a medium severity level.
CVE-2026-92378 is a session management vulnerability in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may persist after logout. This could allow a subsequent user to gain unauthorized limited access by being authenticated as the previous user. The vulnerability affects versions from 0 up to and including 2026.2. The CVSS 4.0 base score is 4.1, indicating medium severity.
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the standard chat API. A previously valid, non-permanent application key that remains active after expiration can initialize the MCP endpoint, list the published application's tool metadata, invoke tools/call, and create durable application_chat and application_chat_record state even though /chat/api/open rejects the same key. No fixed version is available as of this review.
Apache Airflow versions 3.0.0 through 3.3.1 have an insufficient session expiration vulnerability in the Core API logout endpoint. When API clients authenticate using a bearer token in the Authorization header, logging out does not revoke the token, allowing it to remain valid until its configured expiration (default 24 hours). An attacker with a copy of a valid token can maintain access after the victim logs out. This issue is fixed in Apache Airflow 3.3.2.
A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being properly sanitised when another user, including administrative staff, views the affected profile. Successful exploitation could allow JavaScript code to be executed in the victim’s browser, access to information available within the session, or the performance of actions using the victim’s permissions.
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated.
A resource configured with session_identifier :jti and require_token_presence_for_authentication? disabled stores its session value as <jti>:<subject>. The jti is there so that signing out can revoke that one session. Neither reader consults it: AshAuthentication.Plug.Helpers.authenticate_resource_from_session/4 and AshAuthentication.Phoenix.LiveSession.on_mount/4 both split the value with split_identifier/2, discard the jti and pass the bare subject to AshAuthentication.subject_to_user/3, which reloads the record. The token-presence branch of each function does check its token, calling AshAuthentication.TokenResource.Actions.get_token/3 with the jti and the purpose user. Because the revocation record is never read, neither its revoked state nor its expiry constrains the session, so a session captured before sign-out keeps working.
This issue affects ash_authentication: from 4.9.1 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14; ash_authentication_phoenix: from 2.10.0 before 2.17.4 and from 3.0.0-rc.0 before 3.0.0-rc.11.
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account.
AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored session_params through a rebinding step inside its with chain, conn <- delete_session(conn, session_key). Elixir evaluates the else block in the scope enclosing the with, so every failure path (the provider returning ?error=access_denied, an invalid code, a token-exchange error, or a registration or sign-in failure) reaches store_authentication_result/2 holding the original connection and the session entry is never removed. The value the module's own comment describes as protection against a CSRF-related attack is therefore consumed only when authentication succeeds, and survives a cancelled or failed attempt until the next request phase or session expiry.
This issue affects ash_authentication: from 0.6.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
CVE-2026-82310 is a vulnerability in the Apache Airflow FAB provider where deactivating a user account does not invalidate previously issued tokens. Although password authentication blocks disabled accounts, the Core API continues to accept existing unexpired tokens and allows them to mint replacements, enabling continued access with the original roles. This affects deployments using Airflow 3 with FAB auth manager and Core API token authentication. Upgrading to version 3.9.0 or later mitigates the issue by rejecting tokens for deactivated accounts.
Apache Airflow FAB provider versions 3.2.0 through 3.8.x have a vulnerability where changing a user's password via the Admin user-edit PATCH endpoint does not invalidate existing database-backed sessions. This allows an attacker with a stolen session cookie to maintain access even after the password is changed. The issue affects deployments using the FAB auth manager with database-backed sessions and requires no attacker interaction with the password change endpoint. The vulnerability is fixed in version 3.9.0 and later.
CVE-2026-82311 is a critical vulnerability in the Apache Airflow FAB provider affecting deployments using the FAB auth manager with database-backed session storage. When a user's password is reset, existing sessions are not properly deleted due to a mismatch in identifier comparison, allowing an attacker with a stolen session cookie to maintain access even after the password change. This issue is fixed in version 3.9.0, which corrects the identifier comparison logic. The vulnerability has a CVSS score of 9.8, indicating high severity.
Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid cookie can remain valid after logout or another renewal flow. An attacker who possesses a victim's previously valid stale cookie can replay it over HTTP or HTTPS without knowing the victim's username or password and without victim interaction at exploitation time. Successful replay can take over the victim's account, disclose private data, and permit unauthorized modification or deletion of data available to that account. This issue is fixed in version 5.0.2.
CVE-2026-88262 is a high-severity vulnerability in bizwell xClick affecting versions R2 and R3. It involves insufficient session expiration, which can lead to authentication bypass. This means sessions may remain valid longer than intended, potentially allowing unauthorized access.
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to session theft.
Maravel Framework versions prior to 10.74.0 have a high-severity token replay vulnerability due to a lifecycle mismatch between stateless token validation and relational caching layers. This flaw causes blacklisted JWT tokens to be prematurely evicted from cache, allowing them to be reused for up to 14 days. The issue arises from the tymon/jwt-auth package's use of cache tags with a forced 2-hour eviction ceiling, which truncates the intended 14-day blacklist lifespan. Cache flushes or natural evictions invalidate blacklist records, enabling token replay attacks. The vulnerability is architectural and not fixed by a simple framework upgrade; version 10.74.0 introduces a workaround to decouple token identifiers from tagged caches. Users must apply configuration changes to avoid early cache evictions and ensure token blacklists persist for their full lifespan.
CVE-2026-55513 is a medium severity vulnerability in forgekeep nebula-mesh versions 0.3.0 up to but not including 0.5.0. The issue involves insufficient session expiration where the nebula-mgmt Web UI host-creation path ignores configured enrollment token TTL settings and instead hardcodes a 24-hour token lifetime. This allows authenticated operators who can create hosts via the Web UI to mint bearer enrollment tokens valid for about 24 hours, potentially longer than intended by security policies. The vulnerability has been patched in version 0.5.0.
HCL IntelliOps Event Management (IEM) has a session deletion vulnerability (CVE-2025-62342) where user sessions may not be fully terminated after logout or deletion. This insufficient session expiration could allow sessions to remain active longer than intended. The vulnerability has a CVSS score of 6.4, indicating medium severity. No patch or official remediation guidance is currently available. There are no known exploits in the wild, and affected versions have not been specified.
Apache Tomcat has an Insufficient Session Expiration vulnerability (CVE-2026-73180) where authenticated WebSocket sessions may persist after the associated HTTP session ends if the session ID changes. This affects multiple versions across Tomcat 7, 8.5, 9, 10.1, and 11 branches. The vulnerability is fixed in versions 11.0.25, 10.1.58, and 9.0.121. Users should upgrade to these or later versions to mitigate the issue.