Skip to contentCWE-613 vulnerabilities
- sourcecodester online boat reservation systemSourceCodester Online Boat Reservation System session expirationCVE-2026-147255.3 Medium
@grackle-ai/auth npm, @grackle-ai/mcp npm, @grackle-ai/plugin-core npm +2 moreGrackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)GHSA-f9ff-5x35-7gfw8.7 High- surrealdbSurrealDB before 3.1.0 Authentication Bypass via LIVE QueryCVE-2026-63753Fix available5.3 Medium
- hcl software devops loop, ibm devops automation +1 moreIBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.CVE-2025-363598.1 High
- evoke csmsEVoke Systems EVoke CSMS Insufficient Session ExpirationCVE-2026-544796.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: attacker can re-enable and take over disabled clients via registration access tokenCVE-2026-9705Fix available6.5 Medium
- rocket.chatRocket.Chat: OAuth access and refresh tokens remain valid after account deactivationCVE-2026-492772.3 Low
- rocket.chatRocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokensCVE-2026-457572.3 Low
- gogsGogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVESCVE-2026-52809Fix available6.8 Medium
- actualbudget actualActual: Disabled OpenID users keep access through existing session tokensCVE-2026-49229Fix available8.3 High
- mattermost, mattermost server +1 moreGlobal session revocation does not invalidate active WebSocket connectionsCVE-2026-9162Fix available4.3 Medium
- berriai litellmBerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expirationCVE-2026-127965.3 Medium
- berriai litellmBerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expirationCVE-2026-127725.3 Medium
- langflowLangflow: Logout button does not clear sessionCVE-2026-55423Fix available6.1 Medium
- corewcfCoreWCF: SAML token replay protection is inoperativeCVE-2026-54779Fix available5.9 Medium
- zitadelZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP ProviderCVE-2026-56664Fix available4.2 Medium
- buddhathemes hydroHydro: Insufficient session expiration when recreating sessionsCVE-2026-55617Fix available6.9 Medium
- nocodbNocoDB: Refresh Tokens Persist Through Password RecoveryCVE-2026-539286.3 Medium
- hcl icontrolHCL iControl was affected by Inadequate Session Timeout vulnerabilityCVE-2025-623403.1 Low
- daytonaio daytonaDaytona: Public sandbox previews remain accessible for up to one hour after being made privateCVE-2026-54321Fix available7.0 High
- openclawOpenClaw < 2026.5.26 - Node Token Revocation Bypass via Pairing-Scoped Device SessionCVE-2026-53843Fix available8.7 High
- perryts perryPerry < 0.5.1166 JWT Expiration Bypass via verify_decodeCVE-2026-537769.3 Critical
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.7 +2 moreAnsible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expirationCVE-2026-441885.3 Medium
- openclawOpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reloadCVE-2026-53830Fix available6.0 Medium
- openclawMattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh DelayCVE-2026-53824Fix available6.0 Medium
- bluditBludit's persistent authentication tokens not revoked upon account disablementCVE-2026-466577.1 High
- bluditBludit CMS has improper authorization and mediation failure leading to persistent ghost sessionsCVE-2026-466568.8 High
- haxtheweb issuesHAX CMS PHP has Insufficient Session ExpirationCVE-2026-464015.3 Medium
- nocodbNocoDB: OAuth Tokens Persist Through Security EventsCVE-2026-53926Fix available6.3 Medium
- apache airflowApache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout pathCVE-2026-48726Fix available6.5 Medium
- casdoorCVE-2026-9096CVE-2026-90967.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restartCVE-2026-9802Fix available6.8 Medium
- avantraInsecure session handling on metrics web serverCVE-2026-86709.6 Critical
- nocodbNocoDB: Stale Auth Cache After API Token DeletionCVE-2026-465542.3 Low
- gardyn mobile applicationSession Hijacking in TEİAŞ's Mobile ApplicationCVE-2026-18155.7 Medium
edumfa PyPIeduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challengesGHSA-j5rm-v3vh-vx94Fix available8.7 High- strapi, strapi @strapi/admin, @strapi/plugin-users-permissions +2 moreStrapi: Password Reset Does Not Revoke Existing Refresh SessionsCVE-2026-22706Public exploitFix available2.1 Low
- sillytavernSillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeoverCVE-2026-44648Public exploitFix available7.5 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreInsufficient Session Invalidation on User Account Deactivation in AOS-8 Operating SystemCVE-2026-448735.4 Medium
- pocket-id pocket id, pocket-id +1 morePocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictionsCVE-2026-43983Fix available8.5 High
- dani-garcia vaultwardenVaultwarden: Refresh tokens not invalidated on security stamp rotationCVE-2026-439116.8 Medium
- open-webui, openwebui open webui +1 moreopen-webui - Remote Code Execution via CORS Misconfiguration and Session ValidationCVE-2026-56400Fix available9.0 Critical
- openwebui open webui, open-webui +1 moreOpen WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note AccessCVE-2026-44553Fix available8.1 High
github.com/nhost/nhost Gonhost has Session Persistence After Password ChangeGHSA-7hgr-xvrr-xpw3Fix available2.3 Low- lin-snow ech0Ech0 before 4.7.3 Access Token Revocation BypassCVE-2026-79664Fix available9.1 Critical
- freescout-help-desk freescoutFreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaksCVE-2026-419029.1 Critical
github.com/daptin/daptin GoDaptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password ChangeGHSA-258c-965c-p3hcFix available6.5 Medium- katalyst koiKatalyst Koi: Session cookies can be replayed after user logoutCVE-2026-44511Fix available7.4 High
- openclawOpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After RotationCVE-2026-45005Fix available5.9 Medium
- jupyter server, jupyter-server jupyter server +1 morejupyter-server authentication cookies remain valid after password reset due to static cookie secretCVE-2026-40934Fix available7.6 High
- Show moreLoading…