CWE-613 vulnerabilities

CVE-2026-73180 is an Insufficient Session Expiration vulnerability in Apache Tomcat affecting multiple versions. The issue occurs when a session ID for an authenticated HTTP session changes after a WebSocket connection is established; the WebSocket session does not close as required when the HTTP session ends. This affects Apache Tomcat versions from 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120, as well as some older EOL versions. Users are advised to upgrade to fixed versions 11.0.25, 10.1.58, or 9.0.121.

The TYPO3 extension "SYSSY - TYPO3 Monitoring & Security Checks" contains a vulnerability where it does not properly validate the expiration of client-supplied JWT tokens. This flaw allows an attacker who already possesses a valid API key to authenticate using an expired token. The vulnerability affects versions from 0 up to but not including 3.0.6. It has a medium severity rating with a CVSS score of 5.3.

CVE-2026-14950 is a critical vulnerability in Frauscher Sensortechnik's FDS 102 product where an unauthenticated remote attacker with a valid session identifier can continue to use the session after it should have expired. This flaw allows unauthorized continued access to the FDS web interface, increasing the risk from stolen, leaked, shared, or unattended sessions.

FUXA versions 1.3.2 and earlier suffer from insufficient session expiration, allowing attackers with previously issued privileged refresh cookies or access tokens to continue minting privileged JWTs even after account deletion or role changes. This enables unauthorized persistent access to sensitive functions such as user management and backdoor account creation. The vulnerability is fixed in version 1.3.3.

CVE-2026-66376 is a medium severity vulnerability in JFrog Artifactory where credentials for a deleted user may remain valid for a short period under specific conditions due to insufficient session expiration. This could allow continued access with deleted user credentials until sessions expire.

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

OpenReception appointment booking software versions prior to 1.0.2 have an insufficient session expiration vulnerability. When users log out via the /logout page, the session revocation is not properly executed due to a server-side ordering error, leaving the session valid until its natural expiry. This allows an attacker with a copied access token to continue making authenticated API calls despite the user seeing a successful logout. The issue is fixed starting with version 1.0.2, which correctly revokes the session before deleting authentication cookies.

CVE-2025-12317 is a medium severity vulnerability in WSO2 Enterprise Integrator version 6.6.0 where the system does not invalidate authentication tokens after internal user roles are removed. This allows users to retain access privileges associated with revoked roles until tokens expire naturally, potentially enabling unauthorized actions or access to restricted resources.

CVE-2025-12627 is a vulnerability in WSO2 Identity Server versions 7.0.0 and 7.1.0 where the user impersonation flow does not properly expire refresh tokens. This allows an attacker with an access token for an impersonated user to use the refresh token to obtain new access tokens, extending unauthorized access. The flaw compromises log integrity and traceability by masking the true actor. The CVSS score is low, reflecting limited impact on confidentiality and availability but some impact on integrity.

WSO2 API Manager versions 3.1.0 through 4.6.0 have a vulnerability where unused authorization codes issued to deleted users are not properly invalidated. This allows these codes to persist and potentially be reused by attackers who have the authorization code and client credentials, enabling unauthorized access to resources within the scope of the original authorization.

CVE-2026-60053 is a critical vulnerability in Apache Answer versions prior to 2.0.2. It involves insufficient session expiration where administrative API keys remain valid even after the associated administrator account is demoted, suspended, marked inactive, or deleted. This flaw allows continued unauthorized access until the keys are explicitly removed. The issue is resolved in Apache Answer version 2.0.2.

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.

CVE-2026-14465 is an insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc.'s HUMANIST Digital Human Resources product. The flaw allows session IDs to be reused, potentially enabling session replay attacks. This affects version 26.0 of the software prior to 26.1. The vulnerability has a medium severity with a CVSS score of 6.5. No official patch or remediation guidance has been provided yet by the vendor.

An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the system.

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.

IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 contain a vulnerability related to insufficient session expiration. This weakness can lead to unauthorized access due to sessions not terminating properly. The vulnerability is identified as CWE-613 and has a high severity with a CVSS score of 8.2.

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.