CWE-613 Insufficient Session Expiration

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

pyLoad: Api.set_user_permission never invalidates the target's session

fast-jwt: Verifier cache accepts expired JWTs without iat.

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

wger: API credentials remain valid after logout/password change

Langflow: Logout button does not clear session

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation

BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration

Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

Duplicate Advisory: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES

NocoDB: Refresh Tokens Persist Through Password Recovery

NocoDB: OAuth Tokens Persist Through Security Events