CWE-324 Use of a Key Past its Expiration Date
Description
The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-324 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-wqqc-jjcq-vfxm | CVE-2026-54787 | LOW |
sigstore-go fails to check signature timestamps against a signing key's validity period |
2026-07-31 | |
| GHSA-5c3f-6486-3g7g | CVE-2026-52809 | MODERATE |
Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES |
2026-07-21 | |
| GHSA-xmxx-7p24-h892 | CVE-2026-43585 | CRITICAL |
OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation |
2026-05-12 | |
| GHSA-3rw9-wmc8-8948 | - | LOW |
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token |
2025-08-28 | |
| GHSA-xmmm-jw76-q7vg | CVE-2024-7318 | MODERATE |
Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity |
2024-12-20 | |
| GHSA-57rh-gr4v-j5f6 | - | MODERATE |
Duplicate Advisory: Keycloak Uses a Key Past its Expiration Date |
2024-12-20 | |
| GHSA-4rrr-j7ff-r844 | CVE-2013-2104 | HIGH |
python-keystoneclient missing expiration check in PKI token validation |
2024-10-25 | |
| GHSA-w66p-78g4-mr7g | CVE-2012-5563 | HIGH |
OpenStack Keystone Insufficient token expiration |
2024-09-27 | |
| GHSA-r82w-3phg-qvr4 | CVE-2024-38277 | MODERATE | - |
Moodle uses the same key for QR login and auto-login |
2024-06-27 |
| GHSA-j99g-qjvx-995g | CVE-2019-10643 | CRITICAL | - |
Contao Does Not Expire Tokens Correctly |
2024-04-25 |
| GHSA-6cp7-g972-w9m9 | CVE-2022-24732 | MODERATE |
Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server |
2022-03-18 |