Skip to contentCWE-613 vulnerabilities
- solidinvoiceSolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation linksCVE-2026-616086.8 Medium
- wwbn avideoWWBN AVideo Password Recovery Token Expiration BypassCVE-2026-844809.3 Critical
- usememos memosMemos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password ChangeCVE-2026-842038.6 High
- quantumnous new-apiQuantumNous new-api Revoked API Token token session expirationCVE-2026-829095.3 Medium
- jeremyevans rodauthRodauth before 2.47.0 Authentication Bypass via jwt_refreshCVE-2026-82469Fix available5.1 Medium
- flowintelFlowintel Fails to Invalidate Active Sessions After Password ChangeCVE-2026-818269.1 Critical
- hcl software iemHCL IntelliOps Event Management is affected by multiple security vulnerabilities.CVE-2025-623426.4 Medium
- typo3 extension "syssy - typo3 monitoring & security checks"Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)CVE-2026-771305.3 Medium
- hexpmExplicit organization scopes survive token refresh after membership endsCVE-2026-755542.3 Low
- frauscher sensortechnik fds 102Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logicCVE-2026-149509.2 Critical
- apache tomcatApache Tomcat: Authenticated WebSocket session survives end of HTTP sessionCVE-2026-73180Fix available6.8 Medium
- frangoteam fuxaFUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessionsCVE-2026-659847.5 High
- dokployDokploy: Password Change Does Not Revoke Active SessionsCVE-2026-457915.9 Medium
- filebrowserFile Browser 2.50.0 through 2.63.21 JWT Expiration BypassCVE-2026-736117.6 High
- jfrog artifactoryDeleted users may temporarily retain access to JFrog ArtifactoryCVE-2026-663764.2 Medium
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Session Not Invalidated on User Account Deletion or DeactivationCVE-2026-176008.7 High
- open-reception appointment-booking-softwareOpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiryCVE-2026-480797.4 High
- wso2 enterprise integrator, identity server +1 moreImproper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access PrivilegesCVE-2025-123175.0 Medium
- wso2 identity server, carbon oauth +1 moreImproper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized ActionsCVE-2025-126272.4 Low
- wso2 api control plane, api manager, identity server +6 more +8 moreAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessCVE-2024-89954.9 Medium
- apache answerApache Answer: Residual Administrative API Key Access After Role or Account RevocationCVE-2026-600539.1 Critical
- flarum frameworkFlarum < 1.8.16 Session Persistence via Improper Access Token RevocationCVE-2026-399247.6 High
- go-shiori shiorishiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or DemotionCVE-2026-71206Public exploit8.2 High
- bilin software and informatics consultancy inc. humanist digital human resourcesSession Fixation in Bilin Software's HUMANIST Digital Human ResourcesCVE-2026-144656.5 Medium
- No product listedAn issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management...CVE-2026-519537.4 High
- ibm operations analytics - log analysisIBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password changeCVE-2024-406836.3 Medium
- mikrotik routerosInsufficient session expiration in MikroTik RouterOSCVE-2026-142276.9 Medium
- dfir-iris iris-webDFIR-IRIS Insufficient Logout ImplementationCVE-2026-169704.2 Medium
- getgrav gravGrav Login Plugin before 3.8.13 Insufficient Session ExpirationCVE-2026-664006.3 Medium
- ibm aspera faspex 5, aspera faspex +1 moreMultiple vulnerabilities in IBM Aspera FaspexCVE-2026-149968.2 High
- progress moveit transferMOVEit Transfer refresh-token processing does not enforce updated account restrictionsCVE-2026-159677.5 High
- q2a question2answerQuestion2Answer 1.8.8 Session Fixation via Forgot-Password FlowCVE-2026-648299.1 Critical
- gitea open source git serverGitea Remember-Me Token Theft Not Invalidating Attacker SessionCVE-2026-56750Fix available9.1 Critical
- hcl software mycloud, hcltech dryice mycloud +1 moreHCL MyCloud was affected with Concurrent Login Vulnerability.CVE-2026-565833.1 Low
- django-oauth django-oauth-toolkitdjango-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expirationCVE-2026-16206Fix available5.3 Medium
- wg-easyWireGuard Easy Weak Token Generation Information Disclosure via OTL RouteCVE-2026-630899.0 Critical
- lookyloo playwrightcaptureCross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCaptureCVE-2026-631757.1 High
- getgrav gravGrav before 2.0.4 Improper Session Invalidation JWT Access TokensCVE-2026-614526.9 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Insufficient Session Expiration (CWE-613)CVE-2026-483292.7 Low
- forgekeep nebula-meshnebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensCVE-2026-55513Fix available5.4 Medium
- hydro-québec le circuit electrique charging station backendHydro-Québec Le Circuit Electrique charging station backend Insufficient Session ExpirationCVE-2026-443838.7 High
- zitadelZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP ProviderCVE-2026-56665Fix available4.2 Medium
- apache software foundation iotdbApache IoTDB: REST Basic Authentication Accepts Stale Cached CredentialsCVE-2026-285649.8 Critical
- forgekeep nebula-meshnebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateCVE-2026-53602Fix available6.9 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logoutCVE-2026-59219Fix available7.1 High
- better-authbetter-auth Stale Sessions Persist After User DeletionCVE-2026-67334Fix available5.1 Medium
- @better-auth oauth-provider, better-auth, better-auth better auth +1 more +3 moreBetter Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family ForkingCVE-2026-53517Fix available8.1 High
- coollabsio coolifyCoolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent AccessCVE-2026-421723.1 Low
- fossbillingSuspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flowsCVE-2026-439188.7 High
- apache camelApache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be acceptedCVE-2026-46455Public exploitFix available9.8 Critical
- Show moreLoading…