Skip to content
CWE-613 vulnerabilities
-
hcl aion
HCL AION is affected by multiple security vulnerabilities.
CVE-2026-66986
3.3 Low
-
ericsson codechecker
Session Token Remains Valid After Logout in Multi-Worker Deployments
CVE-2026-84155
5.3 Medium
-
apache software foundation ofbiz
Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
CVE-2026-82907
9.8 Critical
-
shenzhen shine industrial co., ltd. vitafit
VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure
CVE-2026-54375
8.6 High
-
blueprintue blueprintue-self-hosted-edition
blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
CVE-2026-121735
6.3 Medium
-
wso2 api control plane, api manager, carbon oauth +6 more +8 more
Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
CVE-2024-9517
4.9 Medium
-
mathurvishal cloudclassroom-php-project
mathurvishal CloudClassroom-PHP-Project Global Session session expiration
CVE-2026-120340
6.3 Medium
-
apache software foundation wicket
Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation
CVE-2026-82559
2.3 Low
-
roostorg coop
Coop sessions are not invalidated on password reset
CVE-2026-63400
2.3 Low
-
pgadmin 4, pgadmin.org pgadmin 4 +1 more
pgAdmin 4: A user's other sessions survive a change of their password
CVE-2026-116251
2.3 Low
-
arcadedata arcadedb
ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections
CVE-2026-119577
7.6 High
-
No product listed
An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its...
CVE-2025-49602
9.8 Critical
-
@graphql-tools executor-legacy-ws, ardatan graphql-tools +1 more
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
CVE-2026-118665
Fix available
8.2 High
-
wso2 identity server, carbon oauth +1 more
Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
CVE-2026-6647
7.4 High
-
wso2 api control plane, api manager, carbon oauth +6 more +8 more
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
CVE-2026-3583
3.1 Low
-
@fastify/session
@fastify/session vulnerable to session revocation bypass via a logout race condition
CVE-2026-117499
3.7 Low
-
opnsense core
REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
CVE-2026-116894
2.3 Low
-
alexandregz twofactor gauthenticator
Insufficient session expiration in twofactor_gauthenticator
CVE-2026-107146
6.3 Medium
-
apache camel
Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
CVE-2026-95663
Public exploit
4.8 Medium
-
kiloview e3 firmware
Kiloview E3 NDI Encoder Insufficient Session Expiration
CVE-2026-96616
8.3 High
-
openbao
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass
CVE-2026-115362
Fix available
2.1 Low
-
openbao
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation
CVE-2026-115356
Fix available
5.3 Medium
-
supabase realtime
Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization
CVE-2026-54238
3.1 Low
-
encode django-rest-framework
Django REST framework: TokenProxy.delete() reports success and revokes nothing
CVE-2026-114137
Fix available
7.4 High
-
mikrotik routeros
MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
CVE-2026-89035
9.1 Critical
-
wso2 identity server, carbon oauth +1 more
Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
CVE-2025-0326
7.4 High
-
ibm storage ts4500 library
TS4500 Tape Library Insufficient Session Expiration
CVE-2025-36069
5.5 Medium
-
ibm storage ts4500 library
TS4500 Tape Library Insufficient Session Expiration
CVE-2025-36252
6.3 Medium
-
wso2 api control plane, api manager, carbon oauth +6 more +8 more
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
CVE-2025-13173
6.5 Medium
-
netskope client
Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue
CVE-2026-12254
6.4 Medium
-
@fastify/oauth2
@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
CVE-2026-110008
4.2 Medium
-
apache software foundation answer
Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
CVE-2026-79624
9.8 Critical
-
@fastify/jwt
@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults
CVE-2026-110024
6.8 Medium
-
apache software foundation airflow keycloak provider
Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
CVE-2026-96806
5.8 Medium
-
error311 filerise
FileRise: Remember-me auto-login uses stale admin role from token instead of current role
CVE-2026-57493
6.8 Medium
-
progress moveit transfer
MOVEit Transfer Access restriction bypass in OAuth authentication
CVE-2026-89073
7.5 High
-
auth0 auth0.js
Missing Verification of auth_time Claim in auth0.js
CVE-2026-107371
5.4 Medium
-
wazuh wazuh-manager
Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
CVE-2026-74037
8.6 High
-
0xjacky nginx-ui
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
CVE-2026-84321
Fix available
5.4 Medium
-
heymrun heym
Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens
CVE-2026-109362
5.3 Medium
-
getgrav grav-plugin-api
Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
CVE-2026-109320
5.3 Medium
-
open-webui
Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket
CVE-2026-109289
5.3 Medium
-
otrs ag otrs
Insufficient Session Revocation for JWT Authentication
CVE-2026-78357
9.1 Critical
-
eleveo call recording software
Eleveo Call Recording Software logout session expiration
CVE-2026-108809
5.1 Medium
-
y project ruoyi
y_project RuoYi Disable API add changeStatus session expiration
CVE-2026-108803
5.3 Medium
-
macrozheng mall
macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration
CVE-2026-108785
5.3 Medium
-
go-vikunja vikunja
Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
CVE-2026-111919
7.1 High
-
go-vikunja vikunja
Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
CVE-2026-111917
Fix available
7.1 High
-
pyload-ng PyPI
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
GHSA-jq7h-wrvp-3rgx
7.5 High
-
pyload-ng PyPI
pyLoad: Api.set_user_permission never invalidates the target's session
GHSA-889w-m37p-88m5
7.5 High
- Show olderLoading…