CVE-2026-9705

Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token

A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak

CVE-2026-49277

Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat does not revoke OAuth bearer or refresh tokens when a user is deactivated. A deactivated user can continue using an existing OAuth access token, and can also mint a fresh access token from an existing refresh token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Rocketchat

Products

Rocket.chat

CVE-2025-71335

Flowise - Session Invalidation Failure After Password Change

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Flowiseai

Products

Flowise

CVE-2026-54479

EVoke Systems EVoke CSMS Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Evoke

Products

Evoke Csms

CVE-2026-9802

Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak

CVE-2026-45757

Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has marked inactive for idleness can still access authenticated REST endpoints with the old token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Rocketchat

Products

Rocket.chat

CVE-2026-53926

NocoDB: OAuth Tokens Persist Through Security Events

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called from passwordChange, passwordForgot, and passwordReset. OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out. This vulnerability is fixed in 2026.05.1.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-54321

Daytona: Public sandbox previews remain accessible for up to one hour after being made private

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox's visibility changed. This vulnerability is fixed in 0.184.0.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Daytonaio

Products

Daytona

CVE-2026-55423

Langflow: Logout button does not clear session

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Langflow

Products

Langflow

CVE-2026-53928

NocoDB: Refresh Tokens Persist Through Password Recovery

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password. passwordChange and passwordReset deleted the user's refresh tokens, but passwordForgot only rotated token_version and revoked OAuth tokens — it did not call UserRefreshToken.deleteAllUserToken(user.id). An attacker holding a captured refresh cookie could still exchange it for a new access token after the victim triggered the recovery flow. This vulnerability is fixed in 2026.05.1.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-46554

NocoDB: Stale Auth Cache After API Token Deletion

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authenticate requests until their cache entry expired, because the auth cache was not invalidated by token value at deletion time. The API token deletion path removed the database row but did not evict the token-value keyed entry from the auth cache. The auth middleware therefore continued to accept the deleted token until the cache entry aged out, leaving a deletion-to-revocation window of up to three days. This vulnerability is fixed in 2026.04.4.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-12796

BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration

A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Berriai Litellm

Products

Litellm Litellm

CVE-2026-12772

BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Berriai Litellm

Products

Litellm Litellm

CVE-2026-9162

Global session revocation does not invalidate active WebSocket connections

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Server

CVE-2025-62340

HCL iControl was affected by Inadequate Session Timeout vulnerability

HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automatically terminate user sessions after a period of inactivity

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Icontrol

CVE-2026-53843

OpenClaw < 2026.5.26 - Node Token Revocation Bypass via Pairing-Scoped Device Session

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-32663

IGL-Technologies eParking.fi Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Igl Igl-technologies

Products

Eparking.fi Eparking.fi

CVE-2026-25476

OpenEMR has Session Timeout Bypass via skip_timeout_reset

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the session expiration check in `library/auth.inc.php` runs only when `skip_timeout_reset` is not present in the request. When `skip_timeout_reset=1` is sent, the entire block that calls `SessionTracker::isSessionExpired()` and forces logout on timeout is skipped. As a result, any request that includes this parameter (e.g. from auto-refresh pages like the Patient Flow Board) never runs the expiration check: expired sessions can continue to access data indefinitely, abandoned workstations stay active, and an attacker with a stolen session cookie can keep sending `skip_timeout_reset=1` to avoid being logged out. Version 8.0.0 fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2024-22403

OAuth2 authorization codes are valid indefinetly in Nextcloud server

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Nextcloud Server

CVE-2023-4005

Insufficient Session Expiration in fossbilling/fossbilling

Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Fossbilling

Products

Fossbilling