CWE-613 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-613 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
CVE-2026-82310Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account…1.0%높음7.2CVE-2026-86533Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthenticatio…0.6%심각9.1CVE-2026-82311Apache Airflow FAB provider: resetting a user's password does not delete that user's existing databa…0.6%심각9.8CVE-2026-55250Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-…0.6%높음8.7CVE-2026-86473Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token co…0.5%심각9.1CVE-2026-114137Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delet…0.5%높음7.4CVE-2026-86462Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint d…0.5%심각9.1CVE-2026-81637Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker w…0.5%낮음2.3
전체 목록
97건
CVE-2026-67242RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard sk…0.5%보통6.3
CVE-2026-86698Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organ…0.4%낮음2.3
CVE-2026-118665GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36…0.4%높음8.2
CVE-2026-74037Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because c…0.4%높음8.6
CVE-2026-96616Authentication tokens issued by the E3's web management interface on login are given an expiration time far be…0.4%높음8.3
CVE-2026-79313webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relie…0.4%심각9.8
CVE-2026-120340A weakness has been identified in mathurvishal CloudClassroom-PHP-Project. This issue affects some unknown pro…0.4%낮음2.9
CVE-2026-92976A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.…0.4%보통5.1
CVE-2026-107146The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verifi…0.3%보통6.3
CVE-2026-75907The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-…0.4%높음7.5
CVE-2026-88262Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affec…0.3%높음8.7
CVE-2026-97056SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tok…0.4%높음7.6
CVE-2026-96806The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the prese…0.3%보통5.8
CVE-2026-92616FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-pri…0.3%높음7.6
CVE-2026-83540When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token …0.3%높음7.7
CVE-2026-107721fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts In…0.3%보통5.9
CVE-2026-81268IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain …0.3%높음8.1
CVE-2026-89073Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer:…0.3%높음7.5
CVE-2026-107275@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span …0.3%보통6.8
CVE-2026-82559Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettings#newWebSocket…0.3%낮음2.3
CVE-2026-78357Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user ac…0.3%심각9.1
CVE-2026-119577ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain a…0.3%높음7.6
CVE-2026-92358A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request f…0.3%보통6.4
CVE-2026-87014Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1,…0.3%보통6.5
CVE-2026-108785A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHead…0.3%낮음2.1
CVE-2026-55617Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recrea…0.3%보통6.9
CVE-2026-89035MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that al…0.3%심각9.1
CVE-2026-100502Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allow…0.3%보통5.9
CVE-2026-111919Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collabora…0.3%높음7.1
CVE-2026-111917Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep…0.3%높음7.1
CVE-2026-63400Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates …0.3%낮음2.3
CVE-2026-79317A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cooki…0.3%보통4.8
CVE-2026-3583When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediat…0.3%낮음3.1
CVE-2026-104084SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh token…0.3%높음8.7
CVE-2026-82566The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication sta…0.3%높음8.7
CVE-2026-103283Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff u…0.3%높음8.6
CVE-2026-92800Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at paren…0.2%높음7.6
CVE-2024-8122The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in mult…0.3%보통5.9
CVE-2026-100711froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies whe…0.3%높음8.7
CVE-2026-95663Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Ca…0.2%보통4.8
CVE-2026-104468YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse …0.3%보통6.3
CVE-2026-88805Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even afte…0.3%높음8.1
CVE-2026-97212The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple end…0.2%보통6.9
CVE-2026-87720Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache …0.3%높음7.6
CVE-2026-61608SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no e…0.2%보통6.8
CVE-2026-109320The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that…0.2%보통5.3
CVE-2026-12254Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while c…0.2%보통6.4
CVE-2026-57493FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior …0.2%보통6.8
CVE-2026-77519MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authenticati…0.2%보통5.4
CVE-2026-71575The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a millisecond…0.2%미평가
CVE-2026-107719fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache …0.2%보통4.2
CVE-2026-85387Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-che…0.2%낮음2.0
CVE-2026-6647In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive data…0.2%높음7.4
CVE-2026-115356OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Au…0.2%보통5.3
CVE-2026-105690Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-to…0.2%보통5.9
CVE-2026-100624Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId …0.2%보통5.3
CVE-2026-109289Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated u…0.2%보통5.3
CVE-2026-100554OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HT…0.2%낮음2.3
CVE-2026-86215A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown funct…0.2%낮음2.1
CVE-2026-54238Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1,…0.2%낮음3.1
CVE-2026-84321Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalo…0.2%보통5.4
CVE-2026-107371When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth…0.2%보통5.4
CVE-2026-79624Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.…0.2%미평가
CVE-2026-115362OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth met…0.2%낮음2.1
CVE-2026-108803A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeSta…0.2%보통5.3
CVE-2026-55513nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5…0.2%보통5.4
CVE-2026-92920admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers t…0.2%보통5.3
CVE-2026-110024@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify m…0.2%보통6.8
CVE-2024-9517The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access to…0.2%보통4.9
CVE-2026-103279Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attack…0.2%높음7.6
CVE-2026-46437wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the aut…0.2%보통4.8
CVE-2026-108809A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown…0.2%낮음2.0
CVE-2026-80174Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00,…0.2%보통5.3
CVE-2026-102367mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint tha…0.2%보통5.3
CVE-2025-71435Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to reta…0.2%낮음2.3
CVE-2026-109362Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to…0.2%보통5.3
CVE-2026-101271OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth…0.2%낮음2.1
CVE-2026-116894REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain…0.2%낮음2.3
CVE-2025-36252IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not …0.2%보통6.3
CVE-2025-13173Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless…0.1%보통6.5
CVE-2025-0326The system fails to invalidate existing access tokens associated with sub-organization users during sensitive …0.1%미평가
CVE-2026-66253iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattende…0.1%낮음3.1
CVE-2026-92378A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW O…0.1%보통4.1
CVE-2025-36069IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could all…0.1%보통5.5
CVE-2026-73586Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Sessi…0.1%보통6.4
CVE-2026-116251pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's…0.1%낮음2.3
CVE-2026-110008@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and co…0.1%보통4.2
CVE-2026-117499@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling sess…0.1%낮음3.7
CVE-2026-121735blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that al…보통6.3
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.