Search Vulnerabilities

MOVEit Transfer refresh-token processing does not enforce updated account restrictions

Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow

HCL MyCloud was affected with Concurrent Login Vulnerability.

SurrealDB before 3.1.0 Authentication Bypass via LIVE Query

django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration

WireGuard Easy Weak Token Generation Information Disclosure via OTL Route

Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCapture

Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens

open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation

ColdFusion | Insufficient Session Expiration (CWE-613)

Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

CoreWCF: SAML token replay protection is inoperative

Actual: Disabled OpenID users keep access through existing session tokens

Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access

Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows

Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allow...