Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 756

Export CSV
CVE-2026-14950

Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logic

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Frauscher Sensortechnik
Products
Fds 102
CVE-2026-66376

Deleted users may temporarily retain access to JFrog Artifactory

Credentials for a deleted user may remain valid for a short period under specific conditions.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Jfrog
Products
Artifactory
CVE-2026-84480

WWBN AVideo Password Recovery Token Expiration Bypass

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-82909

QuantumNous new-api Revoked API Token token session expiration

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Quantumnous
Products
New-api
CVE-2026-84203

Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Usememos
Products
Memos
CVE-2026-82469

Rodauth before 2.47.0 Authentication Bypass via jwt_refresh

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Jeremyevans
Products
Rodauth
CVE-2026-59307

Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Integration Spring Integration
CVE-2026-77130

Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Typo3
Products
Extension "syssy - Typo3 Monitoring & Security Checks"
CVE-2025-62342

HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcl Software
Products
Iem
CVE-2026-81826

Flowintel Fails to Invalidate Active Sessions After Password Change

Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that attacker’s access. The session remains usable until it expires naturally. The upstream commit describes this directly as: “session keeps working until it expires.” The fix detects password changes and explicitly invokes _invalidate_user_sessions(user.id) after the database update. This is applied in both edit_user_core() and admin_edit_user_core(). Version impacted >=3.3.0

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Flowintel
Products
Flowintel
CVE-2026-73180

Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Tomcat
CVE-2026-75554

Explicit organization scopes survive token refresh after membership ends

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:<org> or docs:<org> scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime. This issue affects hex.pm: from 2025-10-10 before 2026-08-24.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Hexpm
Products
Hexpm
CVE-2026-79664

Ech0 before 4.7.3 Access Token Revocation Bypass

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ech0 Lin-snow
Products
Ech0 Ech0
CVE-2026-44188

Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration

A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth (Open Authorization) access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backend, leaving it valid until its natural expiration. This can lead to unauthorized read access to Ansible resources such as inventories, playbooks, and configuration data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform
CVE-2026-65984

FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js re-signs inbound JWT claims without validating the current database record. An attacker who possesses a previously issued privileged refresh cookie or access token can continue minting privileged JWTs after account deletion, disablement, role removal, or demotion. Continued refresh-cookie rotation can extend the stale session and preserve unauthorized access to user management, project manipulation, runtime configuration, scripts, and backdoor-account creation. This issue is fixed in version 1.3.3.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Frangoteam
Products
Fuxa
CVE-2026-45791

Dokploy: Password Change Does Not Revoke Active Sessions

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-73611

File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Filebrowser
Products
Filebrowser
CVE-2026-39924

Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Flarum
Products
Flarum Framework
CVE-2024-40683

IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the system.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Operations Analytics - Log Analysis Operations Analytics Log Analysis