Skip to contentCWE-613 vulnerabilities
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreKeycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removedCVE-2025-12110Fix available5.4 Medium
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 moreKeycloak-server: too long and not settings compliant sessionCVE-2025-11429Fix available5.4 Medium
- strapiLack of JWT Expiration after Log Out in StrapiCVE-2025-3930Fix available6.3 Medium
- fortinet fortiisolatorAn insufficient session expiration vulnerability [CWE-613] and an incorrect authorization...CVE-2024-335077.0 High
- fortinet fortiosAn Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2...CVE-2025-252524.3 Medium
- joinmastodon mastodonMastodon allows continued access after password reset via CLICVE-2025-62174Fix available3.5 Low
- whimsies-yat vickeyVickey's unexpired email confirmation link can be reused to send repeated confirmation emailsCVE-2025-617756.9 Medium
- ibm transformation extender advancedIBM Transformation Extender Advanced session fixationCVE-2023-498816.3 Medium
- freshrssFreshRSS has Incomplete Session Termination on LogoutCVE-2025-545928.8 High
- flagforgeFlagForgeCTF's Improper Session Handling Allows Access After LogoutCVE-2025-598419.8 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP does not properly expire sessionsCVE-2025-43819Fix available5.3 Medium
- cubecart, cubecart v6 +1 moreCubeCart Session Not Invalidated After Password ChangeCVE-2025-593357.1 High
- cisa thoriumCISA Thorium does not properly invalidate previously used tokensCVE-2025-354332.3 Low
- axxonsoft axxon one, axxonone c-werk +1 moreImproper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk)CVE-2025-102235.3 Medium
- ethyca fidesFides's Admin UI User Password Change Does Not Invalidate Current SessionCVE-2025-57766Fix available1.7 Low
- coderCoder's privilege escalation vulnerability could lead to a cross workspace compromiseCVE-2025-58437Fix available8.1 High
- weblateWeblate has long session expiry times during second factor verificationCVE-2025-58352Fix available2.1 Low
- envoyproxy envoyEnvoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flagCVE-2025-55162Fix available6.3 Medium
- payload cms payloadLack of JWT Expiration after Log Out in PayloadCMSCVE-2025-4643Fix available6.3 Medium
- coderCoder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh TokenCVE-2025-71435Fix available2.3 Low
- siemens smartclient modules opcenter ql home (sc), soa audit, soa cockpit +1 more +3 moreA vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >=...CVE-2024-419852.1 Low
- ibm aspera faspexIBM Aspera Faspex session fixationCVE-2025-360406.5 Medium
- phpgurukul bank locker management systemImproper session invalidation in the component /banker/change-password.php of PHPGurukul Bank...CVE-2025-504917.1 High
- phpgurukul online library management systemImproper session invalidation in the component /library/change-password.php of PHPGurukul Online...CVE-2025-504887.1 High
- phpgurukul blood bank \& donor management systemImproper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood...CVE-2025-504877.1 High
- phpgurukul e-diary management systemImproper session invalidation in the component /carrental/update-password.php of PHPGurukul Car...CVE-2025-504867.1 High
- phpgurukul online course registrationImproper session invalidation in the component /crm/change-password.php of PHPGurukul Online...CVE-2025-504857.1 High
- phpgurukul small crmImproper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM...CVE-2025-504847.1 High
- hcl software iautomate, hcltech dryice iautomate +1 moreHCL iAutomate is affected by an insufficient session expirationCVE-2025-319527.1 High
- fortinet fortiisolator, fortisandbox +1 moreAn insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4...CVE-2024-277796.3 Medium
- filebrowserFileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after LogoutCVE-2025-538267.7 High
- haxtheweb issues, psu haxcms-nodejs, haxcms-php +2 morehaxcms-nodejs and haxcms-php Improperly Terminate SessionsCVE-2025-536424.8 Medium
- abb lite panel proApplication does not invalidate session after password resetCVE-2025-44076.8 Medium
- microsens nmp web+Insufficient Session Expiration in MICROSENS NMP Web+CVE-2025-491528.7 High
- ash-project ash authentication phoenixMissing Session Revocation on Logout in ash_authentication_phoenixCVE-2025-4754Fix available2.3 Low
- fortinet fortios, fortipam, fortiproxy +2 more +4 moreAn Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0,...CVE-2024-50562Public exploit4.4 Medium
- ibm cloud pak for security, qradar suite software, qradar suite +2 moreIBM QRadar Suite Software and IBM Cloud Pak for Security session fixationCVE-2025-250194.8 Medium
- ibm planning analytics localIBM Planning Analytics Local session fixationCVE-2025-330056.3 Medium
- smarsh telemessage, telemessage service +1 moreThe TeleMessage service through 2025-05-05 implements authentication through a long-lived...CVE-2025-489294.0 Medium
- wireapp wire-webappwire-webapp Has Insufficient Session Invalidation after User LogoutCVE-2025-480615.6 Medium
- palo alto networks compute in prisma cloud enterprise edition, prisma cloud compute edition +1 morePrisma Cloud Compute Edition: Insufficient Session Expiration Vulnerability in the Web InterfaceCVE-2025-01382.0 Low
- siemens simatic pcs neo v4.1, simatic pcs neo v5.0, simatic pcs neo +2 moreA vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3),...CVE-2025-405668.7 High
- schweitzer engineering laboratories sel blueframe osImproper Privilege ManagementCVE-2025-467415.7 Medium
- digitro ngc explorerDígitro NGC Explorer session expirationCVE-2025-45285.3 Medium
- rack rack-sessionRack session gets restored after deletionCVE-2025-46336Fix available4.2 Medium
- rackRack session gets restored after deletionCVE-2025-32441Fix available4.2 Medium
- zitadelZITADEL Allows IdP Intent Token ReuseCVE-2025-46815Fix available8.0 High
- auth0 nextjs-auth0Auth0 NextJS SDK v4 Missing Session InvalidationCVE-2025-46344Fix available4.9 Medium
- albedo telecom net.time - ptp/ntp clock (serial no. nbc0081p)ALBEDO Telecom Net.Time - PTP/NTP Clock Insufficient Session ExpirationCVE-2025-21858.5 High
- franka robotics emika robotImproper session handlingCVE-2021-476638.1 High
- Show moreLoading…