Monthly
Persistent API key access in IBM Langflow OSS 1.0.0-1.11.5 allows authenticated remote attackers to continue executing AI workflows and extracting sensitive data even after their user accounts have been deactivated. The vulnerability stems from insufficient session expiration (CWE-613): API keys issued to users are not invalidated when those accounts are disabled, leaving a persistent backdoor for former users or compromised credentials. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS reflects High confidentiality and High integrity impact, driven by the ability to both execute flows and access sensitive pipeline data.
Account takeover in WWBN AVideo is possible because userRecoverPassSave.json.php never checks whether a password-recovery token has expired, so any captured token stays valid forever. An attacker who obtains a recovery token for a target account can reset that account's password at an arbitrary later time and seize full control. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-j9p7-hm85-9v77); no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Persistent account takeover in Memos 0.26.0-0.30.0 is enabled by a failure to invalidate refresh tokens upon password change. An attacker who possesses a stolen refresh token can indefinitely call the RefreshToken RPC to rotate both the refresh token and obtain fresh access tokens, making the victim's password-change security response completely ineffective. No public exploit has been identified at time of analysis, but the vulnerability is straightforward to exploit once a token is obtained, and CVSS 4.0 rates the impact as High on both confidentiality and integrity.
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidate existing authenticated sessions when a user changes their password. An attacker who already holds a valid session token (from prior access or theft) keeps full authenticated access to the account even after the victim resets the password, since the old session remains usable until natural expiry. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; a vendor fix commit exists.
Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an attacker who has stolen a 'never-expire' access token retain valid authenticated access indefinitely. Because such tokens carry no JWT 'exp' claim, all three revocation paths fail - logout panics on the nil ExpiresAt field, RevokeToken short-circuits when remaining TTL is zero, and admin 'Delete token' never blacklists the JTI - so a leaked token stays cryptographically valid until the operator rotates the signing key. No public exploit identified at time of analysis; there is no CISA KEV listing and no POC referenced in the provided intelligence.
Session fixation/expiration weakness in the Frauscher Sensortechnik FDS 102 web interface (versions 2.1.0 through 2.13.3) allows an attacker holding a valid session identifier to keep using that session after it should have expired, granting continued access to the management interface. Because sessions are not invalidated on the expected schedule, stolen, leaked, shared, or unattended session tokens remain usable well beyond their intended lifetime. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (Critical) reflects high impact once a token is obtained.
Insufficient session expiration in FUXA 1.3.2 and earlier allows a former privileged user to continue minting valid privileged JWTs long after their account has been deleted, disabled, demoted, or had roles removed. The refresh endpoint falls back to stale group data embedded in the token rather than enforcing a live database check, and the heartbeat endpoint re-signs inbound JWT claims without validating the current database record, enabling indefinite session extension through cookie rotation. No public exploit code has been identified at time of analysis, but the fix is available in v1.3.3 and the GitHub advisory and patch commit are public.
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy authentication is configured with a non-default logout page, enabling an attacker who possesses any previously valid token to access protected routes and administrative endpoints beyond the token's expiration window. The authentication middleware intentionally waived JWT expiration under proxy-auth - since the proxy is expected to govern session lifetime - but failed to require the proxy to simultaneously assert the user's identity on each request, meaning a leaked or captured token could authenticate independently and indefinitely. No public exploit code has been identified at time of analysis; the fix commit and vendor security advisory are publicly available.
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full repository access after their account is deleted, deactivated, or their password is changed. Any user holding an active session at the moment of an administrative revocation event can continue reading, modifying, or deleting repository content until that session naturally times out - bypassing the intended access control action. No public exploit has been identified and this is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects the high-impact triad of confidentiality, integrity, and availability against network-accessible repositories once the prerequisite session exists.
OpenReception's appointment booking platform (prior to v1.0.2) leaves server-side sessions active for up to one week after a user explicitly logs out, due to an operation-ordering bug in the SvelteKit logout route. An attacker who has already obtained a copy of the victim's access token - through network interception, browser storage access on a shared device, or another independent theft vector - can continue making fully authenticated API calls against the platform even after the victim believes their session has ended. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the C:H/I:H impact reflects unrestricted access to the victim's appointment API surface for the duration of the unexpired session.
Persistent API key access in IBM Langflow OSS 1.0.0-1.11.5 allows authenticated remote attackers to continue executing AI workflows and extracting sensitive data even after their user accounts have been deactivated. The vulnerability stems from insufficient session expiration (CWE-613): API keys issued to users are not invalidated when those accounts are disabled, leaving a persistent backdoor for former users or compromised credentials. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS reflects High confidentiality and High integrity impact, driven by the ability to both execute flows and access sensitive pipeline data.
Account takeover in WWBN AVideo is possible because userRecoverPassSave.json.php never checks whether a password-recovery token has expired, so any captured token stays valid forever. An attacker who obtains a recovery token for a target account can reset that account's password at an arbitrary later time and seize full control. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-j9p7-hm85-9v77); no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Persistent account takeover in Memos 0.26.0-0.30.0 is enabled by a failure to invalidate refresh tokens upon password change. An attacker who possesses a stolen refresh token can indefinitely call the RefreshToken RPC to rotate both the refresh token and obtain fresh access tokens, making the victim's password-change security response completely ineffective. No public exploit has been identified at time of analysis, but the vulnerability is straightforward to exploit once a token is obtained, and CVSS 4.0 rates the impact as High on both confidentiality and integrity.
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidate existing authenticated sessions when a user changes their password. An attacker who already holds a valid session token (from prior access or theft) keeps full authenticated access to the account even after the victim resets the password, since the old session remains usable until natural expiry. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; a vendor fix commit exists.
Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an attacker who has stolen a 'never-expire' access token retain valid authenticated access indefinitely. Because such tokens carry no JWT 'exp' claim, all three revocation paths fail - logout panics on the nil ExpiresAt field, RevokeToken short-circuits when remaining TTL is zero, and admin 'Delete token' never blacklists the JTI - so a leaked token stays cryptographically valid until the operator rotates the signing key. No public exploit identified at time of analysis; there is no CISA KEV listing and no POC referenced in the provided intelligence.
Session fixation/expiration weakness in the Frauscher Sensortechnik FDS 102 web interface (versions 2.1.0 through 2.13.3) allows an attacker holding a valid session identifier to keep using that session after it should have expired, granting continued access to the management interface. Because sessions are not invalidated on the expected schedule, stolen, leaked, shared, or unattended session tokens remain usable well beyond their intended lifetime. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (Critical) reflects high impact once a token is obtained.
Insufficient session expiration in FUXA 1.3.2 and earlier allows a former privileged user to continue minting valid privileged JWTs long after their account has been deleted, disabled, demoted, or had roles removed. The refresh endpoint falls back to stale group data embedded in the token rather than enforcing a live database check, and the heartbeat endpoint re-signs inbound JWT claims without validating the current database record, enabling indefinite session extension through cookie rotation. No public exploit code has been identified at time of analysis, but the fix is available in v1.3.3 and the GitHub advisory and patch commit are public.
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy authentication is configured with a non-default logout page, enabling an attacker who possesses any previously valid token to access protected routes and administrative endpoints beyond the token's expiration window. The authentication middleware intentionally waived JWT expiration under proxy-auth - since the proxy is expected to govern session lifetime - but failed to require the proxy to simultaneously assert the user's identity on each request, meaning a leaked or captured token could authenticate independently and indefinitely. No public exploit code has been identified at time of analysis; the fix commit and vendor security advisory are publicly available.
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full repository access after their account is deleted, deactivated, or their password is changed. Any user holding an active session at the moment of an administrative revocation event can continue reading, modifying, or deleting repository content until that session naturally times out - bypassing the intended access control action. No public exploit has been identified and this is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects the high-impact triad of confidentiality, integrity, and availability against network-accessible repositories once the prerequisite session exists.
OpenReception's appointment booking platform (prior to v1.0.2) leaves server-side sessions active for up to one week after a user explicitly logs out, due to an operation-ordering bug in the SvelteKit logout route. An attacker who has already obtained a copy of the victim's access token - through network interception, browser storage access on a shared device, or another independent theft vector - can continue making fully authenticated API calls against the platform even after the victim believes their session has ended. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the C:H/I:H impact reflects unrestricted access to the victim's appointment API surface for the duration of the unexpired session.