CWE-613
CWE-613 · 6 records · 4 with a public proof-of-concept
Records the NVD classes under CWE-613, highest CVSS first.
- CRITICAL 9.8CVE-2026-82311public PoC
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's i…
apache-airflow-providers-fab
- CRITICAL 9.1CVE-2026-86462public PoC
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that …
apache-airflow-providers-fab
- HIGH 8.3CVE-2026-71206public PoC
Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in…
- HIGH 7.2CVE-2026-82310public PoC
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming i…
apache-airflow-providers-fab
- MEDIUM 6.5CVE-2026-14465
Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (aka Session Replay). This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
- MEDIUM 6.4CVE-2026-92358
A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established …