CVE-2025-36069 TS4500 Tape Library Insufficient Session Expiration

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2025-36069

The IBM Storage TS4500 Library (versions 1.1.1.6 through 1.12.0.3 ) is vulnerable to Insufficient Session Expiration (CWE-613). The Web UI and REST interfaces fail to properly invalidate active user sessions following security-sensitive actions, such as logouts, password changes, password resets,...

CVE-2025-36252

The IBM Storage TS4500 Library (versions 1.1.1.6 through 1.12.0.3) and Diamondback Tape Library are vulnerable to CVE-2025-36252 due to Insufficient Session Expiration (CWE-613). The Web UI fails to generate a new session identifier after successful authentication, allowing pre-authentication ide...

CVE-2026-79624

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...

EUVD-2026-104162

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...

CVE-2025-56643

CVE-2025-56643 Public reference for CVE-2025-56643 – Wiki.js 2.5.307 JWT Session Vulnerability Description: Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the...

Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2025-36069

Summary The Web UI and REST interfaces did not properly invalidate active user sessions after security-sensitive account changes, including password changes, password resets, or role and privilege updates, allowing previously issued session tokens to remain valid and potentially be reused to acce...

CVE-2026-89073

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89073

Progress MOVEit Transfer is impacted by an Insufficient Session Expiration vulnerability (CWE-613 ). This flaw affects versions prior to 2025.1.6 and versions from 2026.0.0 to before 2026.0.4 . The vulnerability could allow unauthorized session persistence, potentially leading to high impact on c...

CVE-2026-89073 MOVEit Transfer Access restriction bypass in OAuth authentication

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

EUVD-2026-101155

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89073: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-114325

🚨 CVE-2026-89073 Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. 🎖@cveNotify...

CVE-2026-57493: Insufficient Session Expiration

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...

CVE-2026-107371: Insufficient Session Expiration

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

CVE-2026-74037: Insufficient Session Expiration

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-84321: Insufficient Session Expiration

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain i...

CVE-2026-108809: Insufficient Session Expiration

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is...

Insufficient Session Expiration

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Insufficient Session Expiration via the verifier cache in src/verifier.js, where the cacheSet function only derived exp and nbf bounds from a token's payload when the iat claim was also...

Insufficient Session Expiration

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Insufficient Session Expiration in src/verifier.js when the clockTimestamp, clockTolerance, or cacheTTL verifier options are set to non-finite values such as Infinity or NaN. The previous...