{"@ID": "1472", "@Name": "Generation of Credential with Long Expiration", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product generates or relies on a credential such as a key,\n\t\tcertificate, password, confirmation code, or token, but the credential\n\t\tdoes not expire or has an expiration that is too long, i.e., the\n\t\texpiration is insufficient for the intended security policy of the\n\t\tproduct.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "284", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "664", "@View_ID": "1000"}]}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Implementation"}, {"Phase": "System Configuration"}, {"Phase": "Operation"}]}, "Common_Consequences": {"Consequence": {"Scope": ["Access Control", "Confidentiality", "Integrity"], "Impact": ["Gain Privileges or Assume Identity", "Bypass Protection Mechanism", "Varies by Context"], "Note": {"xhtml:p": "The consequences vary depending on how the credential is\n\t\t\tintended for use within the product. At the least, a long expiration\n\t\t\tdate gives an attacker more time to steal or guess the credential, and\n\t\t\tif compromised, the attacker would have more time than desired in\n\t\t\torder to conduct malicious activities.", "#text_blocks": ["The consequences vary depending on how the credential is\n\t\t\tintended for use within the product. At the least, a long expiration\n\t\t\tdate gives an attacker more time to steal or guess the credential, and\n\t\t\tif compromised, the attacker would have more time than desired in\n\t\t\torder to conduct malicious activities."]}}}, "Detection_Methods": {"Detection_Method": [{"Method": "Automated Dynamic Analysis", "Description": {"xhtml:p": "If the credentials are provided through a communications\n\t\t\t\tprotocol, monitor the communications related to credential generation\n\t\t\t\tand examine any expiration dates or times that are set.", "#text_blocks": ["If the credentials are provided through a communications\n\t\t\t\tprotocol, monitor the communications related to credential generation\n\t\t\t\tand examine any expiration dates or times that are set."]}}, {"Method": "Manual Analysis", "Description": {"xhtml:p": "Examine the code to determine where credentials are created or\n\t\t\tupdated, and determine how any expiration dates or times are set.", "#text_blocks": ["Examine the code to determine where credentials are created or\n\t\t\tupdated, and determine how any expiration dates or times are set."]}}]}, "Potential_Mitigations": {"Mitigation": [{"Phase": ["Implementation", "Operation"], "Description": {"xhtml:p": "For each credential that is created, reset, or used,\n\t\t\t\tensure that the expiration is set to be as short as possible while\n\t\t\t\tpreserving usability.", "#text_blocks": ["For each credential that is created, reset, or used,\n\t\t\t\tensure that the expiration is set to be as short as possible while\n\t\t\t\tpreserving usability."]}}, {"Phase": "Architecture and Design", "Description": {"xhtml:p": "Design the product to analyze the credentials that it\n\t\t\t\tmanages, and provide mechanisms to provide secure defaults, and/or a\n\t\t\t\tcapability to warn users about excessive expiration.", "#text_blocks": ["Design the product to analyze the credentials that it\n\t\t\t\tmanages, and provide mechanisms to provide secure defaults, and/or a\n\t\t\t\tcapability to warn users about excessive expiration."]}}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2026-96616", "Description": "Video encoder web interface issues authentication tokens\n\t\t\t\twith an expiration time that is longer than the expected session lifetime.", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-96616"}, {"Reference": "CVE-2026-33707", "Description": "Chain: Learning management system generates tokens\n\t\t\twithout an expiration (CWE-1472), making its password reset mechanism\n\t\t\tweak (CWE-640).", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-33707"}, {"Reference": "CVE-2026-26342", "Description": "firmware camera system creates an authentication token\n\t\t\twith insufficient expiration.", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-26342"}, {"Reference": "CVE-2026-21622", "Description": "Package manager for Erlang uses password reset tokens\n\t\t\tthat do not expire.", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-21622"}, {"Reference": "CVE-2026-8760", "Description": "Wordpress plugin generates a One-Time Password (OTP)\n\t\t\twithout an expiration (CWE-1472) and does not perform rate-limiting\n\t\t\t(CWE-307), allowing attackers to compromise accounts via a brute force\n\t\t\tattack.", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-8760"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-1564"}, {"@External_Reference_ID": "REF-1578"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2026-10-26", "Submission_Version": "5.0", "Submission_ReleaseDate": "2026-10-28"}}, "entry_type": "Weakness"}