CWE-613β€”Insufficient Session Expiration

PUBLISHEDweakness record
released 2007-05-07 Β· last modified 2026-04-30

Metadata

CWE ID:
CWE-613
Abstraction:
Base
Structure:
Simple
Status:
Incomplete
Release Date:
2007-05-07
Latest Modification Date:
2026-04-30

Weakness Name

Insufficient Session Expiration

Description

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Common Consequences

Scope:
Access Control
Impact:
Bypass Protection Mechanism

Related Weaknesses

browse all CWEs