CWE-613
Allowed-with-ReviewInsufficient Session Expiration
Abstraction: Base · Status: Incomplete
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
980 vulnerabilities reference this CWE, most recent first.
GHSA-J675-F749-GW7Q
Vulnerability from github – Published: 2026-01-19 18:30 – Updated: 2026-01-19 18:30HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised.
{
"affected": [],
"aliases": [
"CVE-2025-52661"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-19T18:16:03Z",
"severity": "LOW"
},
"details": "HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised.",
"id": "GHSA-j675-f749-gw7q",
"modified": "2026-01-19T18:30:27Z",
"published": "2026-01-19T18:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52661"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/kb_view.do?sys_kb_id=4b92474633de7ad4159a05273e5c7b4b\u0026searchTerm=kb0127995#"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J6XF-JWRJ-V5QP
Vulnerability from github – Published: 2025-09-05 20:19 – Updated: 2025-09-10 20:50Summary
Insecure session handling opened room for a privilege escalation scenario in which prebuilt workspaces could be compromised by abusing a shared system identity.
Details
Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user.
When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted.
For example, the coder-login module allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment.
This causes a script to be run on workspace startup that runs the command coder login using the automatically generated user session token c.f. https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23
This module was originally written before the inception of the prebuilds feature in Coder, which essentially creates a "pre-warmed" pool of workspaces owned by a particular prebuilds system user.
When this module is invoked on a prebuilt workspace, it causes the Coder CLI inside the workspace to persist the session token for the prebuilds user to disk. Because the coder-login module checks if the CLI is authenticated, the script exits early before updating the session token, leaving the Coder CLI authenticated as the prebuildsuser upon claim:
Impact
Important: Deployments that have never utilized the prebuilds feature are not affected by this vulnerability.
This vulnerability requires a previously authenticated user to claim a prebuilt workspace from a template configured to store the prebuilds user session token as described above.
The prebuilds user has no specific roles, so its credential has the same level of access as a regular member user, meaning a user with the prebuilds user's credential can move laterally to any other prebuilt workspace, or create new workspaces as the prebuilds user.
This means that a malicious authenticated actor can potentially execute code on other workspaces owned by the prebuilds user and potentially access information of other users once they claim a previously poisoned workspace.
Remediation
Fixed in https://github.com/coder/coder/pull/19667
Note that prebuilt workspaces claimed previous to the fix may have been affected by this vulnerability. It is recommended that users re-create their workspace if it was created from a prebuild.
To identify potentially affected workspaces, run the following SQL query against the Coder database:
SELECT w.id, w.name, w.owner_id, u.email
FROM workspaces w
LEFT JOIN users u ON u.id = w.owner_id
WHERE w.owner_id <> 'c42fdf75-3097-471c-8c33-fb52454d81c0'::uuid
AND NOT w.deleted
AND EXISTS (
SELECT 1
FROM workspace_builds AS wb
WHERE wb.workspace_id = w.id
AND wb.initiator_id = 'c42fdf75-3097-471c-8c33-fb52454d81c0'::uuid
);
Previous manually created tokens for the prebuilds user are left as-is. You may wish to review these via
coder tokens list --all
Premium license customers can also take advantage of the audit logs feature to query actions performed by the prebuilds user.
Following filter can be used to verify if no API keys were created by the prebuilds user
would indicate a potentially malicious action aimed at achieving persistence
username:prebuilds resource_type:api_key
Following filter can be used to list all write operations performed by the prebuilds user (including failed attempts to update various settings)
username:prebuilds action:write
Patched versions
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.22.0"
},
{
"fixed": "2.24.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.25.0"
},
{
"fixed": "2.25.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-58437"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-277",
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-05T20:19:58Z",
"nvd_published_at": "2025-09-06T03:15:40Z",
"severity": "HIGH"
},
"details": "## Summary\n\nInsecure session handling opened room for a privilege escalation scenario in which [prebuilt workspaces](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) could be compromised by abusing a shared system identity.\n\n## Details\n\nCoder automatically generates a session token for a user when a workspace is started. It is automatically exposed via [`coder_workspace_owner.session_token`](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace_owner#session_token-1). Prebuilt workspaces are initially owned by a built-in `prebuilds` system user. \n\nWhen a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the `prebuilds` user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. \n\nFor example, the [coder-login module](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/run.sh) allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment.\n\nThis causes a script to be run on workspace startup that runs the command `coder login` using the automatically generated user session token c.f. [https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23)\n\nThis module was originally written before the inception of the [prebuilds](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) feature in Coder, which essentially creates a \"pre-warmed\" pool of workspaces owned by a particular `prebuilds` system user.\n\nWhen this module is invoked on a prebuilt workspace, it causes the Coder CLI inside the workspace to persist the session token for the `prebuilds` user to disk. Because the `coder-login` module checks if the CLI is authenticated, the script exits early before updating the session token, leaving the Coder CLI authenticated as the `prebuilds`user upon claim:\n\n## Impact\n\n\u003e Important: **Deployments that have never utilized the [prebuilds](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) feature are not affected by this vulnerability.**\n\n\nThis vulnerability requires a previously authenticated user to claim a prebuilt workspace from a template configured to store the prebuilds user session token as described above.\n\nThe `prebuilds` user has no specific roles, so its credential has the same level of access as a regular member user, meaning a user with the `prebuilds` user\u0027s credential can move laterally to any other prebuilt workspace, or create new workspaces as the `prebuilds` user.\n\nThis means that a malicious authenticated actor can potentially execute code on other workspaces owned by the `prebuilds` user and potentially access information of other users once they claim a previously poisoned workspace.\n\n\n## Remediation\n\nFixed in https://github.com/coder/coder/pull/19667\n\nNote that prebuilt workspaces claimed previous to the fix may have been affected by this vulnerability. It is recommended that users re-create their workspace if it was created from a prebuild.\n\nTo identify potentially affected workspaces, run the following SQL query against the Coder database:\n\n```sql\nSELECT w.id, w.name, w.owner_id, u.email\nFROM workspaces w\nLEFT JOIN users u ON u.id = w.owner_id\nWHERE w.owner_id \u003c\u003e \u0027c42fdf75-3097-471c-8c33-fb52454d81c0\u0027::uuid\n AND NOT w.deleted\n AND EXISTS (\n SELECT 1\n FROM workspace_builds AS wb\n WHERE wb.workspace_id = w.id\n AND wb.initiator_id = \u0027c42fdf75-3097-471c-8c33-fb52454d81c0\u0027::uuid\n );\n```\n\n\u003e Previous manually created tokens for the prebuilds user are left as-is. You may wish to review these via `coder tokens list --all`\n\n---\n\n[Premium license](https://coder.com/docs/admin/licensing) customers can also take advantage of the [audit logs](https://coder.com/docs/admin/security/audit-logs) feature to query actions performed by the `prebuilds` user.\n\nFollowing [filter](https://coder.com/docs/admin/security/audit-logs#how-to-filter-audit-logs) can be used to verify if no [API keys](https://coder.com/docs/reference/api/users#create-token-api-key) were created by the `prebuilds` user\n\u003e would indicate a potentially malicious action aimed at achieving [persistence](https://attack.mitre.org/tactics/TA0003/)\n```\nusername:prebuilds resource_type:api_key\n```\n\nFollowing [filter](https://coder.com/docs/admin/security/audit-logs#how-to-filter-audit-logs) can be used to list all *write* operations performed by the `prebuilds` user (including failed attempts to update various settings)\n```\nusername:prebuilds action:write\n```\n\n### Patched versions\n- [2.24.4](https://github.com/coder/coder/releases/tag/v2.24.4)\n- [2.25.2](https://github.com/coder/coder/releases/tag/v2.25.2)\n- [2.26.0](https://github.com/coder/coder/releases/tag/v2.26.0)",
"id": "GHSA-j6xf-jwrj-v5qp",
"modified": "2025-09-10T20:50:29Z",
"published": "2025-09-05T20:19:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58437"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/pull/19667"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/pull/19668"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/pull/19669"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a"
},
{
"type": "PACKAGE",
"url": "https://github.com/coder/coder"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Coder vulnerable to privilege escalation could lead to a cross workspace compromise"
}
GHSA-J79C-Q5MH-CFRH
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-05-24 19:12The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled).
{
"affected": [],
"aliases": [
"CVE-2021-35342"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-27T10:15:00Z",
"severity": "HIGH"
},
"details": "The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled).",
"id": "GHSA-j79c-q5mh-cfrh",
"modified": "2022-05-24T19:12:24Z",
"published": "2022-05-24T19:12:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35342"
},
{
"type": "WEB",
"url": "https://mender.io/blog/cve-2021-35342-useradm-logout-vulnerabililty"
},
{
"type": "WEB",
"url": "https://northern.tech/our-products"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J7WW-PVC6-PH97
Vulnerability from github – Published: 2026-02-27 00:31 – Updated: 2026-03-05 21:30The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
{
"affected": [],
"aliases": [
"CVE-2026-25778"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-27T00:16:57Z",
"severity": "HIGH"
},
"details": "The WebSocket backend uses charging station identifiers to uniquely \nassociate sessions but allows multiple endpoints to connect using the \nsame session identifier. This implementation results in predictable \nsession identifiers and enables session hijacking or shadowing, where \nthe most recent connection displaces the legitimate charging station and\n receives backend commands intended for that station. This vulnerability\n may allow unauthorized users to authenticate as other users or enable a\n malicious actor to cause a denial-of-service condition by overwhelming \nthe backend with valid session requests.",
"id": "GHSA-j7ww-pvc6-ph97",
"modified": "2026-03-05T21:30:27Z",
"published": "2026-02-27T00:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25778"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-06.json"
},
{
"type": "WEB",
"url": "https://swtchenergy.com/contact"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-06"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J868-6X23-744Q
Vulnerability from github – Published: 2026-08-25 09:30 – Updated: 2026-08-25 09:30The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.
{
"affected": [],
"aliases": [
"CVE-2026-77130"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T09:17:33Z",
"severity": "MODERATE"
},
"details": "The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project\u0027s API key.",
"id": "GHSA-j868-6x23-744q",
"modified": "2026-08-25T09:30:39Z",
"published": "2026-08-25T09:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77130"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-015"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J8HM-JP32-F55J
Vulnerability from github – Published: 2022-06-21 00:00 – Updated: 2022-06-29 00:00IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
{
"affected": [],
"aliases": [
"CVE-2022-22318"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-20T17:15:00Z",
"severity": "CRITICAL"
},
"details": "IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.",
"id": "GHSA-j8hm-jp32-f55j",
"modified": "2022-06-29T00:00:57Z",
"published": "2022-06-21T00:00:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22318"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/218283"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6596049"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J8QV-C9RP-9GQJ
Vulnerability from github – Published: 2022-05-13 01:06 – Updated: 2022-05-13 01:06On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the "credential" cookie, which might make it easier for attackers to obtain access at a later time (e.g., "at least for a few minutes"). NOTE: there is no documentation stating that the web UI's logout feature was supposed to do anything beyond removing the cookie from one instance of a web browser; a client-side logout action is often not intended to address cases where a person has made a copy of a cookie outside of a browser.
{
"affected": [],
"aliases": [
"CVE-2018-10990"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-14T14:29:00Z",
"severity": "HIGH"
},
"details": "On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the \"credential\" cookie, which might make it easier for attackers to obtain access at a later time (e.g., \"at least for a few minutes\"). NOTE: there is no documentation stating that the web UI\u0027s logout feature was supposed to do anything beyond removing the cookie from one instance of a web browser; a client-side logout action is often not intended to address cases where a person has made a copy of a cookie outside of a browser.",
"id": "GHSA-j8qv-c9rp-9gqj",
"modified": "2022-05-13T01:06:01Z",
"published": "2022-05-13T01:06:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10990"
},
{
"type": "WEB",
"url": "https://medium.com/@AkshaySharmaUS/comcast-arris-touchstone-gateway-devices-are-vulnerable-heres-the-disclosure-7d603aa9342c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JCGV-XJW5-6WP4
Vulnerability from github – Published: 2025-01-04 03:33 – Updated: 2025-01-06 18:31An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.
{
"affected": [],
"aliases": [
"CVE-2025-22386"
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-04T02:15:07Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.",
"id": "GHSA-jcgv-xjw5-6wp4",
"modified": "2025-01-06T18:31:02Z",
"published": "2025-01-04T03:33:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22386"
},
{
"type": "WEB",
"url": "https://support.optimizely.com/hc/en-us/articles/32695284701069-Configured-Commerce-Security-Advisory-COM-2024-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JCJX-C3J3-44PR
Vulnerability from github – Published: 2021-11-10 16:44 – Updated: 2021-11-08 21:09Impact
A bug introduced in version 1.1.0 made Tokenize generate faulty tokens with NaN as a generation date. As a result, tokens would not properly expire and remain valid regardless of the lastTokenReset field.
Patches
Version 1.1.3 contains a patch that'll invalidate these faulty tokens and make new ones behave as expected.
Workarounds
None. Tokens do not hold the necessary information to perform invalidation anymore.
References
PR #1
For more information
If you have any questions or comments about this advisory: * Open an issue in github.com/cyyynthia/tokenize * Email us at cynthia@cynthia.dev
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@cyyynthia/tokenize"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-08T21:09:02Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nA bug introduced in version 1.1.0 made Tokenize generate faulty tokens with NaN as a generation date. As a result, tokens would not properly expire and remain valid regardless of the `lastTokenReset` field.\n\n### Patches\nVersion 1.1.3 contains a patch that\u0027ll invalidate these faulty tokens and make new ones behave as expected.\n\n### Workarounds\nNone. Tokens do not hold the necessary information to perform invalidation anymore.\n\n### References\nPR #1\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/cyyynthia/tokenize](https://github.com/cyyynthia/tokenize)\n* Email us at [cynthia@cynthia.dev](mailto:cynthia@cynthia.dev)\n",
"id": "GHSA-jcjx-c3j3-44pr",
"modified": "2021-11-08T21:09:02Z",
"published": "2021-11-10T16:44:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cyyynthia/tokenize/security/advisories/GHSA-jcjx-c3j3-44pr"
},
{
"type": "PACKAGE",
"url": "https://github.com/cyyynthia/tokenize"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Insufficient Session Expiration in @cyyynthia/tokenize"
}
GHSA-JG95-R9XH-XW9C
Vulnerability from github – Published: 2024-08-23 21:30 – Updated: 2025-10-13 15:45Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mage-ai"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.9.73"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-45187"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-23T22:51:28Z",
"nvd_published_at": "2024-08-23T19:15:07Z",
"severity": "MODERATE"
},
"details": "Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server.",
"id": "GHSA-jg95-r9xh-xw9c",
"modified": "2025-10-13T15:45:48Z",
"published": "2024-08-23T21:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45187"
},
{
"type": "PACKAGE",
"url": "https://github.com/mage-ai/mage-ai"
},
{
"type": "WEB",
"url": "https://research.jfrog.com/vulnerabilities/mage-ai-deleted-users-rce-jfsa-2024-001039602"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Mage AI incorrectly gives privileges to users with deleted accounts"
}
Mitigation
Set sessions/credentials expiration date.
No CAPEC attack patterns related to this CWE.