CVE-2025-56643

CVE-2025-56643 Referência pública para CVE-2025-56643 – Vulnerabilidade de Sessão JWT do Wiki.js 2.5.307 Descrição: O Requarks Wiki.js 2.5.307 não revoga ou invalida corretamente tokens JWT ativos quando um utilizador termina a sessão. Como resultado, tokens emitidos anteriormente permanecem...

CVE-2026-77130 Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

TYPO3-EXT-SA-2026-015: Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015...

CVE-2026-14950 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logic

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

CVE-2026-14950

FDS102 for FAdC/FAdCi R2 has flawed session expiration logic: a stolen or leaked session identifier remains valid after its intended expiry, enabling continued unauthorized access to the FDS web interface. CVSS 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No patch or exploit detai...

Insufficient Session Expiration

Apache Camel Keycloak Component is vulnerable to Insufficient Session Expiration. The vulnerability is due to KeycloakSecurityHelper.parseAndVerifyAccessToken omitting the TokenVerifier.ISACTIVE check, allowing expired or not-yet-valid access tokens to pass signature, subject, and issuer validati...

CVE-2026-60053

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...

EUVD-2026-53402

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...

CVE-2026-14227

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an...

CVE-2026-66400 Grav Login Plugin before 3.8.13 Insufficient Session Expiration

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...

CVE-2026-66400

Grav Login Plugin = 3.8.13 or follow vendor advisories cited in the references to mitigate.

CVE-2026-15967

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

EUVD-2026-48420

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

CVE-2026-15967

Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

CVE-2026-48329

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...

EUVD-2026-44548

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...

CVE-2026-48329 ColdFusion | Insufficient Session Expiration (CWE-613)

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...

CVE-2026-48329

Technical details about CVE-2026-48329 are not publicly available in the provided documents. Monitor for updates from Adobe/NVD for affected products and remediation information.

CVE-2026-48329 ColdFusion | Insufficient Session Expiration (CWE-613)

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...

CVE-2026-48329

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user...