Common Weakness Enumeration
CWE-324
AllowedUse of a Key Past its Expiration Date
Abstraction: Base · Status: Draft
The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
45 vulnerabilities reference this CWE, most recent first.
GHSA-FGJG-3FMQ-57HW
Vulnerability from github – Published: 2025-11-07 21:31 – Updated: 2025-11-07 21:31
VLAI
Details
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-33012"
],
"database_specific": {
"cwe_ids": [
"CWE-324"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-07T19:15:46Z",
"severity": "MODERATE"
},
"details": "IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date.",
"id": "GHSA-fgjg-3fmq-57hw",
"modified": "2025-11-07T21:31:20Z",
"published": "2025-11-07T21:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33012"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7250469"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-H47G-RCCF-MMX4
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30
VLAI
Details
Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-48813"
],
"database_specific": {
"cwe_ids": [
"CWE-324"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T17:15:42Z",
"severity": "MODERATE"
},
"details": "Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally.",
"id": "GHSA-h47g-rccf-mmx4",
"modified": "2025-10-14T18:30:29Z",
"published": "2025-10-14T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48813"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48813"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J99G-QJVX-995G
Vulnerability from github – Published: 2022-05-13 01:07 – Updated: 2024-04-25 23:15
VLAI
Summary
Contao Does Not Expire Tokens Correctly
Details
Security researcher Ali Razzaq has discovered that confirming an opt-in token does not invalidate previous opt-in tokens in Contao 4.7.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "contao/contao"
},
"ranges": [
{
"events": [
{
"introduced": "4.7.0"
},
{
"fixed": "4.7.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "contao/core-bundle"
},
"ranges": [
{
"events": [
{
"introduced": "4.7.0"
},
{
"fixed": "4.7.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10643"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-324"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T23:15:07Z",
"nvd_published_at": "2019-04-17T19:29:00Z",
"severity": "CRITICAL"
},
"details": "Security researcher Ali Razzaq has discovered that confirming an opt-in token does not invalidate previous opt-in tokens in Contao 4.7.",
"id": "GHSA-j99g-qjvx-995g",
"modified": "2024-04-25T23:15:07Z",
"published": "2022-05-13T01:07:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10643"
},
{
"type": "WEB",
"url": "https://github.com/contao/contao/commit/70348cc812b110831ad66a4f9857883f75649b88"
},
{
"type": "WEB",
"url": "https://contao.org/en/news.html"
},
{
"type": "WEB",
"url": "https://contao.org/en/news/security-vulnerability-cve-2019-10643.html"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-10643.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-10643.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Contao Does Not Expire Tokens Correctly"
}
GHSA-PJ5R-F4H5-QPRV
Vulnerability from github – Published: 2025-08-14 15:30 – Updated: 2025-08-15 12:30
VLAI
Details
Rejected reason: The original vulnerability was not valid.
Severity
4.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-5342"
],
"database_specific": {
"cwe_ids": [
"CWE-324"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-14T13:15:32Z",
"severity": "MODERATE"
},
"details": "Rejected reason: The original vulnerability was not valid.",
"id": "GHSA-pj5r-f4h5-qprv",
"modified": "2025-08-15T12:30:30Z",
"published": "2025-08-14T15:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5342"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-5342"
},
{
"type": "WEB",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-2aa28a4cfc"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2198977"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388707"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJ9W-64MV-P2FW
Vulnerability from github – Published: 2025-04-16 18:31 – Updated: 2025-11-03 21:33
VLAI
Details
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2025-2291"
],
"database_specific": {
"cwe_ids": [
"CWE-324"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T18:16:04Z",
"severity": "HIGH"
},
"details": "Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password",
"id": "GHSA-qj9w-64mv-p2fw",
"modified": "2025-11-03T21:33:40Z",
"published": "2025-04-16T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2291"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00032.html"
},
{
"type": "WEB",
"url": "https://www.pgbouncer.org/changelog.html#pgbouncer-124x"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QW7Q-7PGR-V8PH
Vulnerability from github – Published: 2024-05-22 21:30 – Updated: 2024-05-22 21:30
VLAI
Details
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288175.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-31894"
],
"database_specific": {
"cwe_ids": [
"CWE-324",
"CWE-672"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T20:15:09Z",
"severity": "MODERATE"
},
"details": "IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288175.",
"id": "GHSA-qw7q-7pgr-v8ph",
"modified": "2024-05-22T21:30:35Z",
"published": "2024-05-22T21:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31894"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/288175"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7154606"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R82W-3PHG-QVR4
Vulnerability from github – Published: 2024-06-18 21:30 – Updated: 2024-06-27 03:30
VLAI
Summary
Moodle uses the same key for QR login and auto-login
Details
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0-beta"
},
{
"fixed": "4.4.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.0-beta"
},
{
"fixed": "4.3.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0-beta"
},
{
"fixed": "4.2.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-38277"
],
"database_specific": {
"cwe_ids": [
"CWE-324",
"CWE-326"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-18T22:45:45Z",
"nvd_published_at": "2024-06-18T20:15:14Z",
"severity": "MODERATE"
},
"details": "A unique key should be generated for a user\u0027s QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.",
"id": "GHSA-r82w-3phg-qvr4",
"modified": "2024-06-27T03:30:55Z",
"published": "2024-06-18T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38277"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/0caedaab7cd5a46331d56654ce9301b0a5a04c56"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/1aea4a15281d81f2414a95aa485b8a6551708f57"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/ad46a97f5355f0451d52e9f1a0f528d9a6f12e06"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/d05795db8eece2943241a29a5443fb4685ba6070"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7AZYR7EXV6E5SQE2GYTNQE3NOENJCQ6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GHTIX55J4Q4LEOMLNEA4OZSWVEENQX7E"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=459502"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Moodle uses the same key for QR login and auto-login"
}
GHSA-RJ78-2FM5-WRFP
Vulnerability from github – Published: 2023-01-10 21:30 – Updated: 2023-01-14 06:30
VLAI
Details
An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this vulnerability.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2022-35401"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-324"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-10T21:15:00Z",
"severity": "HIGH"
},
"details": "An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this vulnerability.",
"id": "GHSA-rj78-2fm5-wrfp",
"modified": "2023-01-14T06:30:29Z",
"published": "2023-01-10T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35401"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1586"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W66P-78G4-MR7G
Vulnerability from github – Published: 2022-05-17 01:39 – Updated: 2024-09-27 18:07
VLAI
Summary
OpenStack Keystone Insufficient token expiration
Details
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-5563"
],
"database_specific": {
"cwe_ids": [
"CWE-324",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-14T00:53:23Z",
"nvd_published_at": "2012-12-18T01:55:00Z",
"severity": "HIGH"
},
"details": "OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.",
"id": "GHSA-w66p-78g4-mr7g",
"modified": "2024-09-27T18:07:52Z",
"published": "2022-05-17T01:39:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5563"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea9c081f1eb5"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b28dd3496681"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1079216"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80370"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/keystone"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-20.yaml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20121201003009/http://secunia.com/advisories/51423"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20140802122732/http://secunia.com/advisories/51436"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200228144943/http://www.securityfocus.com/bid/56727"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2012-1557.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/11/28/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/11/28/6"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1641-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenStack Keystone Insufficient token expiration"
}
GHSA-W6PQ-FX2G-C9X6
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31
VLAI
Details
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-13723"
],
"database_specific": {
"cwe_ids": [
"CWE-324"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:53:48Z",
"severity": "MODERATE"
},
"details": "IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token",
"id": "GHSA-w6pq-fx2g-c9x6",
"modified": "2026-03-13T21:31:45Z",
"published": "2026-03-13T21:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13723"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7263391"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Adequate consideration should be put in to the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.
No CAPEC attack patterns related to this CWE.