CWE-324: Use of a Key Past its Expiration Date
The product uses a cryptographic key past its expiration date.
A kind of CWE-672 Operation on a Resource after Expiration or Release.
From the CWE List. © The MITRE Corporation.
Newest
- flarum framework Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset 9.2 Critical
- sigstore sigstore-go sigstore-go fails to check signature timestamps against a signing key's validity period 3.1 Low
- gogs Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES 6.8 Medium
- openclaw OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution 9.2 Critical
- ibm sterling partner engagement manager IBM Sterling Partner Engagement Manager Information Disclosure 5.3 Medium
- ibm db2 IBM Db2 improper account lockout 6.3 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +19 more +21 more Virtual Secure Mode Spoofing Vulnerability 6.3 Medium
- coder Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token 2.3 Low
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 more Shim: expired secure boot certificate 4.1 Medium
- igel os, microsoft windows 10 1507, windows 10 1607 +13 more +15 more In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly... 4.6 Medium
- pgbouncer, debian linux +1 more PgBouncer default auth_query does not take Postgres password expiry into account 8.1 High
- zitadel Zitadel Expired JWT Keys Usable for Authorization Grants 8.7 High
- red hat build of keycloak, build of keycloak 24 +1 more Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity 4.8 Medium
- conduit Use of a Key Past its Expiration Date in Conduit 4.8 Medium
- moodle, fedoraproject fedora +1 more moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys 5.4 Medium
- linux, linux kernel +1 more keys: Fix overwrite of key expiration on instantiation 9.8 Critical
- ibm app connect enterprise IBM App Connect Enterprise information disclosure 4.3 Medium
- ibm app connect enterprise IBM App Connect Enterprise information disclosure 4.3 Medium
- ibm app connect enterprise IBM App Connect Enterprise information disclosure 4.3 Medium
- pquic In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt... 6.5 Medium
- asus rt-ax82u, rt-ax82u firmware +1 more An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT... 9.0 Critical
- openstack keystone, [unknown] openstack-keystone, redhat openstack platform +2 more +4 more A flaw was found in OpenStack. The application credential tokens can be used even after they have... 6.6 Medium
- philips vue pacs, myvue, speech +3 more +5 more Philips Vue PACS Use of a Key Past its Expiration Date 8.2 High
- foxcpp maddy Maddy Mail Server does not implement account expiry 6.3 Medium
- pivotal ops manager, pivotal software operations manager +1 more Ops Manager uaa client issues tokens after refresh token expiration 6.1 Medium
- contao cms Contao Does Not Expire Tokens Correctly 9.8 Critical
- openstack python-keystoneclient python-keystoneclient missing expiration check in PKI token validation 5.5 Medium
- openstack folsom OpenStack Keystone Insufficient token expiration 4.0 Medium