CWE-1469
Weakness AllowedImproper Check for Credential Expiration
Abstraction: Base · Status: Incomplete
The product receives a request that includes a credential such as a key, certificate, password, confirmation code, or token, but the product does not check whether the credential is expired.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Developers might check that the credential exists and is known, without checking if it is expired.
Content history
0 vulnerabilities reference this CWE, most recent first.
No vulnerabilities reference this CWE.
Mitigation
When receiving a credential, look up its expiration to ensure that the credential is still active. If the incoming credential states its own expiration, do not trust this value as it may be part of untrusted input.
Mitigation
Ensure that, for any flow that generates or resets credentials, the expiration is clearly recorded for the credential. Also, ensure that mechanisms exist (such as error handling) for implementations to easily check for expiration, or build in the expiration check as part of the design.
No CAPEC attack patterns related to this CWE.