CWE-613

{
  "affected": [],
  "aliases": [
    "CVE-2026-82469"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-29T17:17:59Z",
    "severity": "MODERATE"
  },
  "details": "Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.",
  "id": "GHSA-mhhp-hxcr-939w",
  "modified": "2026-08-29T18:31:31Z",
  "published": "2026-08-29T18:31:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jeremyevans/rodauth/security/advisories/GHSA-w4fg-qf56-62m2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82469"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jeremyevans/rodauth/commit/8174690cef743177111fb1d9184d129ff4700933"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jeremyevans/rodauth"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/rodauth-before-2.47.0-authentication-bypass-via-jwt-refresh"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "gitaly"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.79.0"
            },
            {
              "fixed": "13.3.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "gitaly"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.4"
            },
            {
              "fixed": "13.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "gitaly"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.5"
            },
            {
              "fixed": "13.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-13353"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-24T18:35:04Z",
    "nvd_published_at": "2020-11-17T01:15:00Z",
    "severity": "LOW"
  },
  "details": "When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. Affected versions are: \u003e=1.79.0, \u003c13.3.9,\u003e=13.4, \u003c13.4.5,\u003e=13.5, \u003c13.5.2.",
  "id": "GHSA-mmmm-chjf-jmvw",
  "modified": "2023-01-24T18:35:04Z",
  "published": "2022-05-24T17:34:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13353"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/gitaly/CVE-2020-13353.yml"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13353.json"
    },
    {
      "type": "PACKAGE",
      "url": "https://gitlab.com/gitlab-org/gitaly"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitaly/-/issues/2882"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gitaly Insufficient Session Expiration vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-79624"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-19T10:16:49Z",
    "severity": null
  },
  "details": "Insufficient session expiration vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nInsufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.",
  "id": "GHSA-mpww-xrm4-2j4x",
  "modified": "2026-10-19T12:32:48Z",
  "published": "2026-10-19T12:32:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79624"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/lpwc1hpnt3fkfwkh00v5j0dvpzqmnoqk"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/10/16/31"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-22591"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-15T21:15:00Z",
    "severity": "LOW"
  },
  "details": "IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for not being invalidated after a password reset. IBM X-Force ID: 243710.",
  "id": "GHSA-mq7j-4cj9-75x8",
  "modified": "2023-03-19T06:30:24Z",
  "published": "2023-03-15T21:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22591"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/243710"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6962175"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-56351"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-20T15:15:08Z",
    "severity": "MODERATE"
  },
  "details": "In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles",
  "id": "GHSA-mqj8-mfff-xrqx",
  "modified": "2024-12-20T15:30:48Z",
  "published": "2024-12-20T15:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56351"
    },
    {
      "type": "WEB",
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-35049"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T15:39:39Z",
    "severity": "CRITICAL"
  },
  "details": "SurveyKing v1.3.1 was discovered to keep users\u0027 sessions active after logout. Related to an incomplete fix for CVE-2022-25590.",
  "id": "GHSA-mqpq-887p-5xgm",
  "modified": "2024-07-03T18:41:12Z",
  "published": "2024-05-14T18:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35049"
    },
    {
      "type": "WEB",
      "url": "https://github.com/javahuang/SurveyKing/issues/55"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-42545"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-30T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH\u2019s TopEase\u00ae Platform Version \u003c= 7.1.27, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions.",
  "id": "GHSA-mqvw-2h8p-cf8g",
  "modified": "2021-12-07T00:01:04Z",
  "published": "2021-12-01T00:00:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42545"
    },
    {
      "type": "WEB",
      "url": "https://confluence.topease.ch/confluence/display/DOC/Release+Notes"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-keycloak"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.18.0"
            },
            {
              "fixed": "4.18.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-keycloak"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.19.0"
            },
            {
              "fixed": "4.21.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46455"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T19:24:06Z",
    "nvd_published_at": "2026-07-06T09:16:36Z",
    "severity": "CRITICAL"
  },
  "details": "Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component.\n\nThe camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subject-exists check and the realm-URL (issuer) check. Keycloak\u0027s TokenVerifier.withChecks(...) appends to an initially empty check list - the upstream default checks are installed only when withDefaultChecks() is called - so the built-in IS_ACTIVE predicate, which validates the token\u0027s exp (expiration) and nbf (not-before) claims, is never applied. As a result the helper verifies the token signature, subject and issuer but does not enforce the token\u0027s validity window: an access token that is expired, or not yet valid, is accepted as valid. Routes that rely on this helper to authenticate inbound requests therefore accept access tokens that are outside their intended lifetime.\nThis issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix makes KeycloakSecurityHelper.parseAndVerifyAccessToken include the TokenVerifier.IS_ACTIVE check so that expired or not-yet-valid access tokens are rejected, aligning the helper with Keycloak\u0027s default check set. For deployments that cannot upgrade immediately, enforce token expiration outside the helper - for example validate the access token\u0027s exp/nbf claims in the route before trusting it, keep Keycloak access-token lifetimes short, and ensure any upstream gateway or resource server also validates the token validity window.",
  "id": "GHSA-mqwc-6qwc-v9gq",
  "modified": "2026-08-28T19:24:06Z",
  "published": "2026-07-06T09:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46455"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/23197"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/23204"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/39133b1ada37c60dea53f3b7db720dbd2ae73fa6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/7f4c4736021aff4fad925eca3bf456b95db038f3"
    },
    {
      "type": "WEB",
      "url": "https://camel.apache.org/security/CVE-2026-46455.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/camel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/releases/tag/camel-4.18.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/releases/tag/camel-4.21.0"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/CAMEL-23504"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/05/8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.6.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "aiohttp-session"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-1000814"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:47:02Z",
    "nvd_published_at": "2018-12-20T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.",
  "id": "GHSA-mr4x-c4v9-x729",
  "modified": "2025-03-14T20:26:12Z",
  "published": "2018-12-20T22:01:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000814"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp-session/issues/325"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp-session/pull/331"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp-session/commit/1b356f01bbab57d041c9a75bacd72fbbf8524728"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-mr4x-c4v9-x729"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aio-libs/aiohttp-session"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp-session/PYSEC-2018-35.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "aiohttp-session creates non-expiring sessions"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.vaadin:vaadin-bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "18.0.0"
            },
            {
              "fixed": "19.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-31408"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-22T14:30:10Z",
    "nvd_published_at": "2021-04-23T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "`Authentication.logout()` helper in `com.vaadin:flow-client` versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.\n\n- https://vaadin.com/security/cve-2021-31408",
  "id": "GHSA-mr8h-j9cv-4m8h",
  "modified": "2021-04-22T14:30:10Z",
  "published": "2021-04-22T16:11:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vaadin/platform/security/advisories/GHSA-mr8h-j9cv-4m8h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31408"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vaadin/flow/pull/10577"
    },
    {
      "type": "WEB",
      "url": "https://vaadin.com/security/cve-2021-31408"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19"
}