Common Weakness Enumeration

CWE-613

Allowed-with-Review

Insufficient Session Expiration

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

1018 vulnerabilities reference this CWE, most recent first.

GHSA-HV2J-4G9F-CHQP

Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-07-17 15:32
VLAI
Details

MICROSENS NMP Web+ contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-49152"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-25T17:15:38Z",
    "severity": "HIGH"
  },
  "details": "MICROSENS NMP Web+\u00a0contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system.",
  "id": "GHSA-hv2j-4g9f-chqp",
  "modified": "2025-07-17T15:32:09Z",
  "published": "2025-06-26T21:31:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49152"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-07"
    },
    {
      "type": "WEB",
      "url": "https://www.microsens.com/support/downloads/nmp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-HVM9-WC8J-MGRC

Vulnerability from github – Published: 2024-12-18 18:19 – Updated: 2024-12-18 18:19
VLAI
Summary
TShock Security Escalation Exploit
Details

Impact

An issue with the way OTAPI manages client connections results in stale UUIDs remaining on RemoteClient instances after a player disconnects.

Because of this, if the following conditions are met a player may assume the login state of a previously connected player: 1. The server has UUID login enabled 2. An authenticated player disconnects 3. A subsequent player connects with a modified client that does not send the ClientUUID#68 packet during connection 4. The server assigns the same RemoteClient object that belonged to the originally authenticated player to the newly connected player

Patches

TShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.

Workarounds

Implement a RemoteClient reset event handler in a plugin like so:

public override void Initialize()
{
        On.Terraria.RemoteClient.Reset += RemoteClient_Reset;
}

private static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)
{
    client.ClientUUID = null;
        orig(client);
}
Severity
8.9 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "TShock"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.3.21"
            },
            {
              "fixed": "5.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-305",
      "CWE-613",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-18T18:19:12Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nAn issue with the way OTAPI manages client connections results in stale UUIDs remaining on `RemoteClient` instances after a player disconnects.\n\nBecause of this, if the following conditions are met a player may assume the login state of a previously connected player:\n1. The server has UUID login enabled\n2. An authenticated player disconnects\n3. A subsequent player connects with a modified client that does not send the `ClientUUID#68` packet during connection\n4. The server assigns the same `RemoteClient` object that belonged to the originally authenticated player to the newly connected player\n\n\n### Patches\nTShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.\n\n### Workarounds\nImplement a RemoteClient reset event handler in a plugin like so:\n```csharp\npublic override void Initialize()\n{\n        On.Terraria.RemoteClient.Reset += RemoteClient_Reset;\n}\n\nprivate static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)\n{\n\tclient.ClientUUID = null;\n        orig(client);\n}\n```\n\n",
  "id": "GHSA-hvm9-wc8j-mgrc",
  "modified": "2024-12-18T18:19:12Z",
  "published": "2024-12-18T18:19:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Pryaxis/TShock/security/advisories/GHSA-hvm9-wc8j-mgrc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Pryaxis/TShock/commit/5075997264b48e27960e3446a948ecb0ea0f5a03"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Pryaxis/TShock"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "TShock Security Escalation Exploit"
}

GHSA-HVP3-26WX-G2W4

Vulnerability from github – Published: 2026-05-13 20:02 – Updated: 2026-05-15 23:44
VLAI
Summary
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
Details

Summary of CVE-2026-22706 Vulnerability Details

  • CVE: CVE-2026-22706
  • CVSS v3.1 Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N (2.1 — Low)
  • Affected Versions: @strapi/admin and @strapi/plugin-users-permissions <=5.33.2
  • How to Patch: Immediately update your Strapi to >=5.33.3

Description of CVE-2026-22706

In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied deviceId. When a password change or reset request did not include a deviceId, no refresh tokens were revoked, leaving every prior session active.

An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure.

The patch invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a deviceId is supplied. A new device-scoped session is then issued to the caller as part of the response.

IoC's for CVE-2026-22706

Indicators that an instance running an unpatched version may have been exploited:

  • Successful POST /api/auth/refresh or POST /admin/access-token requests using a refresh token issued before the user's most recent password change. Reviewable by correlating refresh-token iat claims against password-change events in audit logs
  • New access-token issuances for a user whose password was reset within the past 30 days, originating from an IP or User-Agent that did not perform the reset
  • Multiple active refresh tokens for a single user across distinct IPs after a password reset event
  • Database query: rows in strapi_session with created_at earlier than the user's most recent password-reset timestamp and status = 'active'

References

  • OWASP ASVS 4.0 – V2.1.1: Session invalidation on credential change
  • OWASP Top 10 – A2: Broken Authentication

Credits

  • bugbunny.ai
  • AndyAnh174 (concurrent report, 2026-04-09 — originally filed as GHSA-c6gj-8rxm-jrf2, closed as duplicate)
  • Aastha2602 (concurrent report, 2026-03-10 — originally filed as GHSA-5qvg-4jch-gvf4, closed as duplicate)
Severity
2.1 (Low)
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.33.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@strapi/admin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.33.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.33.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@strapi/plugin-users-permissions"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.33.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22706"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-13T20:02:42Z",
    "nvd_published_at": "2026-05-14T19:16:30Z",
    "severity": "LOW"
  },
  "details": "### Summary of CVE-2026-22706 Vulnerability Details\n\n- CVE: CVE-2026-22706\n- CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` (2.1 \u2014 Low)\n- Affected Versions: `@strapi/admin` and `@strapi/plugin-users-permissions` \u003c=5.33.2\n- How to Patch: Immediately update your Strapi to \u003e=5.33.3\n\n### Description of CVE-2026-22706\n\nIn Strapi versions prior to 5.33.3, changing or resetting a user\u0027s password did not invalidate the user\u0027s existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active.\n\nAn attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure.\n\nThe patch invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a `deviceId` is supplied. A new device-scoped session is then issued to the caller as part of the response.\n\n### IoC\u0027s for CVE-2026-22706\n\nIndicators that an instance running an unpatched version may have been exploited:\n\n- Successful `POST /api/auth/refresh` or `POST /admin/access-token` requests using a refresh token issued before the user\u0027s most recent password change. Reviewable by correlating refresh-token `iat` claims against password-change events in audit logs\n- New access-token issuances for a user whose password was reset within the past 30 days, originating from an IP or User-Agent that did not perform the reset\n- Multiple active refresh tokens for a single user across distinct IPs after a password reset event\n- Database query: rows in `strapi_session` with `created_at` earlier than the user\u0027s most recent password-reset timestamp and `status = \u0027active\u0027`\n\n### References\n\n* OWASP ASVS 4.0 \u2013 V2.1.1: Session invalidation on credential change\n* OWASP Top 10 \u2013 A2: Broken Authentication\n\n### Credits\n\n- bugbunny.ai\n- AndyAnh174 (concurrent report, 2026-04-09 \u2014 originally filed as GHSA-c6gj-8rxm-jrf2, closed as duplicate)\n- Aastha2602 (concurrent report, 2026-03-10 \u2014 originally filed as GHSA-5qvg-4jch-gvf4, closed as duplicate)",
  "id": "GHSA-hvp3-26wx-g2w4",
  "modified": "2026-05-15T23:44:29Z",
  "published": "2026-05-13T20:02:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22706"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/strapi/strapi"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Strapi: Password Reset Does Not Revoke Existing Refresh Sessions"
}

GHSA-HWMM-P4J4-8398

Vulnerability from github – Published: 2022-05-24 16:56 – Updated: 2024-04-04 01:57
VLAI
Details

A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.

Severity
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-14826"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-09-17T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.",
  "id": "GHSA-hwmm-p4j4-8398",
  "modified": "2024-04-04T01:57:58Z",
  "published": "2022-05-24T16:56:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14826"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14826"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J232-863R-9977

Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2022-05-24 22:28
VLAI
Details

In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-25985"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-16T10:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Factor (App Framework \u0026 Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user\u2019s session even after the user logs out of the application. In addition, user sessions are stored in the browser\u2019s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.",
  "id": "GHSA-j232-863r-9977",
  "modified": "2022-05-24T22:28:43Z",
  "published": "2022-05-24T22:28:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25985"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FactorJS/factor/blob/v1.8.30/@factor/user/util.ts#L65"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25985"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-J2W6-JMVX-4Q23

Vulnerability from github – Published: 2025-07-24 21:30 – Updated: 2025-07-24 21:30
VLAI
Details

HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-31952"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-24T21:15:28Z",
    "severity": "HIGH"
  },
  "details": "HCL iAutomate is affected by an insufficient session expiration.  This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access.",
  "id": "GHSA-j2w6-jmvx-4q23",
  "modified": "2025-07-24T21:30:39Z",
  "published": "2025-07-24T21:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31952"
    },
    {
      "type": "WEB",
      "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0122646"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J324-QPQV-2454

Vulnerability from github – Published: 2022-05-24 17:39 – Updated: 2022-05-24 17:39
VLAI
Details

Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and a removal of a login profile.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-3183"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-19T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and a removal of a login profile.",
  "id": "GHSA-j324-qpqv-2454",
  "modified": "2022-05-24T17:39:30Z",
  "published": "2022-05-24T17:39:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3183"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2021/Jan/20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-J4J7-8J5C-5HXW

Vulnerability from github – Published: 2026-07-19 03:30 – Updated: 2026-07-19 03:30
VLAI
Details

A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-16206"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-19T03:16:42Z",
    "severity": "MODERATE"
  },
  "details": "A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "GHSA-j4j7-8j5c-5hxw",
  "modified": "2026-07-19T03:30:21Z",
  "published": "2026-07-19T03:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16206"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-oauth/django-oauth-toolkit/issues/1715"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-oauth/django-oauth-toolkit"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-16206"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/857897"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/857923"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/380022"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/380022/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-J5RM-V3VH-VX94

Vulnerability from github – Published: 2026-05-18 15:37 – Updated: 2026-05-18 15:37
VLAI
Summary
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
Details

Impact

In eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire

Patches

Fixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges.

Workarounds

No known workarounds besides disabling userless login altogether.

Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "edumfa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T15:37:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nIn eduMFA \u003c 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire\n\n### Patches\nFixed in eduMFA \u003e= 2.9.1 by adding validity information to the userless challenges.\n\n### Workarounds\nNo known workarounds besides disabling userless login altogether.",
  "id": "GHSA-j5rm-v3vh-vx94",
  "modified": "2026-05-18T15:37:00Z",
  "published": "2026-05-18T15:37:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/eduMFA/eduMFA/security/advisories/GHSA-j5rm-v3vh-vx94"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/eduMFA/eduMFA"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges "
}

GHSA-J675-F749-GW7Q

Vulnerability from github – Published: 2026-01-19 18:30 – Updated: 2026-01-19 18:30
VLAI
Details

HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised.

Severity
2.4 (Low)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-52661"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-19T18:16:03Z",
    "severity": "LOW"
  },
  "details": "HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised.",
  "id": "GHSA-j675-f749-gw7q",
  "modified": "2026-01-19T18:30:27Z",
  "published": "2026-01-19T18:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52661"
    },
    {
      "type": "WEB",
      "url": "https://support.hcl-software.com/kb_view.do?sys_kb_id=4b92474633de7ad4159a05273e5c7b4b\u0026searchTerm=kb0127995#"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation

Set sessions/credentials expiration date.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list