CVE-2026-104468

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...

EUVD-2026-91479

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...

tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...

tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses tomcat-embed-websocket-10.1.57.jar and logback-classic-1.5.35.jar which are vulnerable to CVE-2026-73180 and CVE-2026-19880. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-19880 DESCRIPTION:...

TencentOS Server 4: tomcat (TSSA-2026:1064)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1064 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

EUVD-2026-88583

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access tha...

CVE-2026-102367

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access tha...

CVE-2026-102367

The mall4j framework (versions through 4.0 ) is vulnerable to an insufficient session expiration issue within the token refresh endpoint . The root cause is a failure to validate the enabled flag when issuing new sessions via the POST /token/refresh endpoint. Consequently, users with disabled acc...

CVE-2026-102367 mall4j through 4.0 Insufficient Session Expiration via Token Refresh

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access tha...

CVE-2026-102367 mall4j through 4.0 Insufficient Session Expiration via Token Refresh

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access tha...

CVE-2026-88805: Insufficient Session Expiration

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

Insufficient Session Expiration

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Insufficient Session Expiration due to failure to invalidate existing session, API keys, and 2FA trust cookies when a user password is changed. An attacker can maintain unauthorized...

CVE-2025-56643

CVE-2025-56643 CVE-2025-56643 的公开参考 – Wiki.js 2.5.307 JWT 会话漏洞 描述： Requarks Wiki.js 2.5.307 在用户登出时未能正确撤销或使活跃的 JWT 令牌失效。 因此，先前发放的令牌仍然有效，可在登出后重新用于访问系统。 此行为影响会话完整性，若令牌泄露，可能导致未经授权的访问。 该问题存在于身份验证解析器逻辑中，影响 GraphQL 端点及登出机制。 受影响产品： Wiki.js – 版本 2.5.307 受影响组件： GraphQL API 端点（/graphql）、认证模块、JWT 会话管理、登出逻辑（U...

EUVD-2026-87368

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502

Flame through version 2.4.0 is vulnerable to an insufficient session expiration vulnerability in its login endpoint. Attackers who possess former administrator access can exploit unvalidated duration parameters to obtain tokens with arbitrary lifespans. Because tokens are verified against a stati...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...