Base de CVEs

CVE-2026-57493 Média · 6.8 CWE-613 14/10/2026

FileRise: Remember-me auto-login uses stale admin role from token instead of current role

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.

CVE-2026-89073 Alta · 7.5 CWE-613 14/10/2026

MOVEit Transfer Access restriction bypass in OAuth authentication

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-107371 Média · 5.4 CWE-613 13/10/2026

Missing Verification of auth_time Claim in auth0.js

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

CVE-2026-74037 Alta · 7.2 CWE-613 13/10/2026

Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.

CVE-2026-84321 Média · 5.4 CWE-613 12/10/2026

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the short_token cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1.

CVE-2026-109362 Média · 5.4 CWE-613 12/10/2026

Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.

CVE-2026-109320 Média · 5.4 CWE-613 12/10/2026

Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.

CVE-2026-109289 Média · 6.3 CWE-613 12/10/2026

Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.

CVE-2026-78357 Crítica · 9.1 CWE-613 12/10/2026

OTRS: tokens JWT continuam válidos após desativação de conta ou troca de senha (CWE-613)

Tokens de autenticação emitidos anteriormente não são invalidados imediatamente quando uma conta de agente ou de usuário cliente do OTRS é desativada ou quando sua senha é alterada. Como resultado, um JWT existente pode permanecer válido até seu tempo normal de expiração, que pode ser de aproximadamente 16 horas. Um atacante que tenha obtido anteriormente um token de autenticação válido pode, portanto, continuar a acessar o OTRS com os privilégios do agente ou usuário cliente afetado, mesmo depois que a conta correspondente tenha sido desativada ou a senha do usuário tenha sido alterada. A vulnerabilidade não permite, por si só, que um atacante obtenha tokens de autenticação. A exploração requer a posse de um token emitido anteriormente e ainda válido. O impacto real depende dos privilégios associados ao token comprometido. Tokens de usuários clientes são limitados às permissões da conta de cliente afetada, enquanto tokens de agentes podem dar acesso a funcionalidades mais amplas de tickets, clientes ou administrativas, dependendo das permissões atribuídas. Este problema afeta o OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X anteriores a 2026.7.X

CVE-2026-108809 Baixa · 3.5 CWE-613 12/10/2026

Eleveo Call Recording Software logout session expiration

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108803 Média · 6.3 CWE-613 12/10/2026

y_project RuoYi Disable API add changeStatus session expiration

A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108785 Média · 6.3 CWE-613 11/10/2026

macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.

CVE-2026-104084 Alta · 8.8 CWE-613 09/10/2026

SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token to obtain a new access token retaining the higher-privilege role (such as DomainAdmin or SysAdmin) until natural token expiry.

CVE-2026-71575 Crítica · 9.1 CWE-613 09/10/2026

Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

CVE-2026-107721 Média · 5.9 CWE-613 08/10/2026

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf comparisons always pass, allowing expired or not-yet-active tokens to be accepted. The verifier cache also derives infinite bounds, so entries created under this configuration can remain valid until eviction. Exploitation requires an application administrator or equivalent configuration path to set clockTolerance to Infinity. This issue is fixed in version 6.3.0.

CVE-2026-107719 Média · 4.2 CWE-613 08/10/2026

fast-jwt: Verifier cache accepts expired JWTs without iat.

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadline only when iat is present, so the cache falls back to cacheTTL, and a later cache hit returns the saved payload before verifyToken rechecks expiration. An attacker who can replay the same cached bearer token can extend access until the cache entry expires, but cannot forge a token through this issue. This issue is fixed in version 6.3.4.

CVE-2024-8122 Média · 5.9 CWE-613 07/10/2026

Potential brute force vulnerability due to non-expiring SMS OTPs

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the OTP. The absence of automatic expiration for OTPs grants attackers an unlimited timeframe to attempt guessing the correct code. A successful brute force attack can lead to an MFA bypass, resulting in the unauthorized takeover of a user's account and compromising the security and privacy of both the individual and the system.

CVE-2026-105690 Média · 5.9 CWE-613 05/10/2026

Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated requests with the victim's authority until natural expiration. This issue is fixed in version 2.18.0.

CVE-2026-97212 Alta · 7.3 CWE-613 02/10/2026

Monta monta.app Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

CVE-2026-81268 Alta · 8.1 CWE-613 10/09/2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.

CVE-2026-87014 Média · 6.5 CWE-613 09/09/2026

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by backend/open_webui/socket/main.py. An administrator demoted through a trusted role header or OAuth role mapping could keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closed. This issue is fixed in version 0.11.1.

CVE-2026-80174 Média · 5.3 CWE-613 09/09/2026

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to session theft.

CVE-2026-86215 Média · 4.3 CWE-613 06/09/2026

A vulnerability was identified in Mstfakts College-Management-System. The affected…

A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the component Logout Handler. Such manipulation of the argument log_out leads to session expiration. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-55513 Média · 5.4 CWE-613 04/09/2026

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0…

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrollment_token_ttl overrides. API host creation and token-regeneration paths use the configured TTL resolver, but POST /ui/hosts hardcodes now.Add(24 * time.Hour) for newly minted agent enrollment tokens. In deployments that intentionally reduce enrollment-token lifetime, any authenticated operator who can create a host through the Web UI can still mint a bearer enrollment token valid for about 24 hours. This issue has been patched in version 0.5.0.

CVE-2026-61608 Média · 6.8 CWE-613 04/09/2026

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1…

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.