CWE-613

699 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 71High 206Medium 344Low 78Not scored 0

CVEs per yearBy the year they were published

CVE-2026-121735
blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
blueprintue · blueprintue-self-hosted-edition
Medium6.3
CVE-2024-9517
Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
WSO2 · WSO2 API Manager
Medium4.9
CVE-2026-120340
mathurvishal CloudClassroom-PHP-Project Global Session session expiration
mathurvishal · CloudClassroom-PHP-Project
Medium6.3
CVE-2026-82559
Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation
Apache Software Foundation · Apache Wicket
Low2.3
CVE-2026-63400
Coop sessions are not invalidated on password reset
roostorg · coop
Low2.3
CVE-2026-116251
pgAdmin 4: A user's other sessions survive a change of their password
pgadmin.org · pgAdmin 4
Low2.3
CVE-2026-119577
ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections
ArcadeData · arcadedb
High7.6
CVE-2025-49602
An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in…
Product not named
Critical9.8
CVE-2026-118665
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
ardatan · graphql-tools
High8.2
CVE-2026-6647
Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
WSO2 · WSO2 Identity Server
High7.4