CVE-2026-128030

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because MageApiModelSession::renewBySessId never checks apiuser.isactive and REST OAuth authorization never checks whether the admin user is active. Attackers holding...

CVE-2026-126427

OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skiptimeoutreset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since...

CVE-2026-126427 OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form

OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skiptimeoutreset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since...

EUVD-2026-125016

OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skiptimeoutreset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since...

CVE-2026-126427

OpenEMR versions before 8.5.0 are vulnerable to an idle session timeout bypass via the Eye Exam form. The root cause is that the read-only poll for this form omits skip_timeout_reset, allowing the update_READONLY() function to reset the idle timer every 15 seconds. An attacker with physical acces...

CVE-2026-128030

The OpenMage magento-lts platform is vulnerable to insufficient session expiration in versions before 20.18.2 and 21.0.0-beta1 (before 21.0.0-beta3 ). The root cause is that the Mage_Api_Model_Session::_renewBySessId() method fails to verify the api_user.is_active status, and REST OAuth authoriza...

EUVD-2026-125072

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because MageApiModelSession::renewBySessId never checks apiuser.isactive and REST OAuth authorization never checks whether the admin user is active. Attackers holding...

EUVD-2026-125047

Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading...

CVE-2026-128330 Miniflux before 2.3.5 Insufficient Session Expiration After Password Change

Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading...

CVE-2026-128330

Miniflux versions before 2.3.5 are vulnerable to an insufficient session expiration flaw. The root cause is that changing a user password does not revoke existing web sessions, allowing an attacker with a leaked password or copied session cookie to maintain access for up to 30 days. Consequences ...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: JWT CheckToken Never Re-Validates Account State Product: go-shiori/shiori File: internal/domains/auth.go CWE: CWE-613 — Insufficient Session Expiration CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 High CNA: Turan Security · CVE record Description Shiori's CheckToke...

CVE-2020-29667

CVE-2020-29667 Insufficient Session Expiration | Predefined Cookie Value Suggested description In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system and operate remote ATM...

CVE-2025-56643

CVE-2025-56643 Public reference for CVE-2025-56643 – Wiki.js 2.5.307 JWT Session Vulnerability Description: Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the...

CVE-2026-126658

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...

CVE-2026-126658 ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keys

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...

EUVD-2026-123402

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...

CVE-2026-126658

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...

CVE-2026-126658 ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keys

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...

CVE-2026-126658

ByteStash versions 1.5.10 before 1.6.2 are vulnerable to an insufficient session expiration flaw involving API keys. The root cause is that the validateApiKey function fails to check the account status, allowing holders of API keys to maintain access even after an account has been deactivated. An...

PT-2026-145210

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...