{"@ID": "1469", "@Name": "Improper Check for Credential Expiration", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product receives a request that includes a credential such as a key, certificate, password, confirmation code, or token, but the product does not check whether the credential is expired.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "284", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "CanPrecede", "@CWE_ID": "672", "@View_ID": "1000", "@Ordinal": "Primary"}]}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation", "Note": {"xhtml:p": "Developers might check that the credential exists and is known, without checking if it is expired.", "#text_blocks": ["Developers might check that the credential exists and is known, without checking if it is expired."]}}}, "Common_Consequences": {"Consequence": {"Scope": ["Access Control", "Confidentiality", "Integrity"], "Impact": ["Gain Privileges or Assume Identity", "Bypass Protection Mechanism"], "Note": {"xhtml:p": "The consequences vary depending on how the credential is\n\t\t\tintended for use within the product. If an attacker steals or guesses\n\t\t\tthe expired credential, then the attacker would have more time than\n\t\t\tdesired in order to conduct malicious activities.", "#text_blocks": ["The consequences vary depending on how the credential is\n\t\t\tintended for use within the product. If an attacker steals or guesses\n\t\t\tthe expired credential, then the attacker would have more time than\n\t\t\tdesired in order to conduct malicious activities."]}}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Implementation", "Description": {"xhtml:p": "When receiving a credential, look up its expiration to\n\t\t\t\tensure that the credential is still active. If the incoming credential\n\t\t\t\tstates its own expiration, do not trust this value as it may be part\n\t\t\t\tof untrusted input.", "#text_blocks": ["When receiving a credential, look up its expiration to\n\t\t\t\tensure that the credential is still active. If the incoming credential\n\t\t\t\tstates its own expiration, do not trust this value as it may be part\n\t\t\t\tof untrusted input."]}}, {"Phase": "Architecture and Design", "Description": {"xhtml:p": "Ensure that, for any flow that generates or resets\n\t\t\t\tcredentials, the expiration is clearly recorded for the\n\t\t\t\tcredential. Also, ensure that mechanisms exist (such as error\n\t\t\t\thandling) for implementations to easily check for expiration, or build\n\t\t\t\tin the expiration check as part of the design.", "#text_blocks": ["Ensure that, for any flow that generates or resets\n\t\t\t\tcredentials, the expiration is clearly recorded for the\n\t\t\t\tcredential. Also, ensure that mechanisms exist (such as error\n\t\t\t\thandling) for implementations to easily check for expiration, or build\n\t\t\t\tin the expiration check as part of the design."]}}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2024-8642", "Description": "Data-sharing product does not check token properties\n\t\t\t\tincluding expiry, allowing attackers to bypass the expiration check.", "Link": "https://www.cve.org/CVERecord?id=CVE-2024-8642"}, {"Reference": "CVE-2023-48220", "Description": "Product does not ensure that a pending invitation is\n\t\t\t\tprocessed before the specified expiry period.", "Link": "https://www.cve.org/CVERecord?id=CVE-2023-48220"}, {"Reference": "CVE-2026-66400", "Description": "Chain: product compares an array to a scalar value\n\t\t\t\t(CWE-1024), effectively bypassing an expiry check for a token\n\t\t\t\t(CWE-xxxx).", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-66400"}, {"Reference": "CVE-2026-67242", "Description": "Product checks expiry for integer values, but not for floats.", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-67242"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2026-10-26", "Submission_Version": "5.0", "Submission_ReleaseDate": "2026-10-28"}}, "entry_type": "Weakness"}