Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay).
This issue affects Avantra: before 25.3.1.
Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking.
This issue affects Mobile Application: from 1.6.2 before 1.13.
Strapi versions prior to 5.33.3 have a vulnerability where changing or resetting a user's password does not invalidate all existing refresh-token sessions unless a deviceId is provided. This allows an attacker with a previously obtained refresh token to maintain persistent unauthorized access even after the user resets their password. The issue is fixed in version 5.33.3, which revokes all refresh tokens on password change or reset regardless of deviceId.
Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated. This vulnerability is fixed in 4.20.0 and 5.6.0.
Vaultwarden versions prior to 1.35.5 contain a vulnerability where refresh tokens are not invalidated after certain security-sensitive user actions, such as password changes or key rotations. This allows an attacker with a previously obtained refresh token to maintain session access despite the user attempting to secure their account. The issue is identified as insufficient session expiration (CWE-613) and has a CVSS score of 6.8 (medium severity). The vulnerability is fixed in version 1.35.5.
FreeScout versions prior to 1.8.217 contain a critical vulnerability in the /user-setup/{hash} endpoint where the invite_hash used for setting a new user's password does not expire. This allows an attacker who obtains a leaked invite hash to perform a permanent unauthenticated account takeover, potentially gaining admin access if the invite was for an admin user. The issue has been fixed in version 1.8.217.
Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" are not revoked. This issue has been patched in version 5.17.1.
CI4MS, a CodeIgniter 4-based CMS skeleton, had an insufficient session expiration vulnerability in versions from 0.26.0 up to but not including 0.31.8.0. Specifically, the authentication filter had the deactivated or banned user check commented out, potentially allowing sessions to remain valid longer than intended. This issue has been addressed and patched in version 0.31.8.
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.
CVE-2026-25720 is a medium severity vulnerability in the SenseLive X3050 web management interface caused by insufficient session expiration. Authenticated sessions remain active for extended periods without requiring re-authentication, allowing an attacker with access to a previously authenticated session to continue administrative interactions after legitimate user activity has ended. There is no confirmed patch or official remediation available at this time.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a security misconfiguration vulnerability related to insufficient session expiration in the user access control panel. This vulnerability is identified as CWE-613. The CVSS score is low (2.7), indicating limited impact. There is no evidence of known exploits in the wild. No official patch or remediation guidance has been provided yet by IBM.
CVE-2026-40939 is a vulnerability in the Data Sharing Framework (DSF) versions prior to 2.1.0 where OIDC-authenticated sessions did not have a maximum inactivity timeout configured. As a result, sessions persisted indefinitely after login, even after the OIDC access token expired. This issue was fixed in version 2.1.0. The vulnerability is classified as CWE-613 (Insufficient Session Expiration) and has a CVSS 4.0 base score of 6.8, indicating medium severity.
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via the profile edit page, or when a password reset is completed via the reset link, neither operation invalidates existing authenticated sessions for that user. A server-side session store associates userID → session; the current password change/reset flow updates only the password column in the users table and does not destroy or mark invalid any active sessions. As a result, an attacker who has already compromised a session retains full access to the account indefinitely — even after the legitimate user has detected the intrusion and changed their password — until the session's natural expiry time (configured as SESSION_GC_MAXLIFETIME, defaulting to 86400 seconds / 24 hours, with SESSION_LIFETIME=0 meaning persistent until browser close or GC, whichever is later). This vulnerability is fixed in 4.2.0.
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation allows previously issued, valid tokens to remain usable, enabling continued access to protected resources by locked user accounts.
The security consequence is that a locked user account can maintain access to protected resources through the use of existing, unexpired access tokens. This creates a security gap where access control policies are bypassed, potentially leading to unauthorized data access or actions until the tokens naturally expire.
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
CVE-2026-1163 is a medium severity vulnerability in parisneo/lollms involving insufficient session expiration. The application does not invalidate active sessions after a password reset, allowing continued use of old session tokens. This is due to missing logic to reject requests after inactivity and a long default session duration of 31 days. An attacker with access to a session token can maintain persistent access to a compromised account even after the password is changed.
Papra versions prior to 26.4.0 contain a vulnerability where API keys with expiration dates are not validated against the current time during authentication. This means expired API keys remain valid indefinitely, allowing continued access to protected endpoints. The issue is identified as insufficient session expiration (CWE-613) and is fixed in version 26.4.0. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-5376 is a medium severity vulnerability in the runZero Platform where session inactivity timeouts may fail to trigger due to automatic page reloading. This is classified as CWE-613, indicating insufficient control of resources after expiration or release. The issue could allow continued access beyond intended session limits, impacting confidentiality and integrity but not availability. The vulnerability has been fixed in version 4.0.260203.0 of the runZero Platform. No known exploits are reported in the wild. Patch status is confirmed by the vendor's version update, though no direct patch link or advisory text is provided.