Advisories · Weakness
CWE-324.
Every Advisory and CVE whose sources give the weakness CWE-324, newest first.
- CVSS 9.2 CriticalCritical · CVSS 9+
Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
- Flarum Framework
- CWE-324
- CVSS 3.1 Low
sigstore-go fails to check signature timestamps against a signing key's validity period
- CWE-324
<1.2.1 · fixed in 1.2.1
GHSA-wqqc-jjcq-vfxm · CVE-2026-54787 - CVSS 6.8 Medium
Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
- Authentication bypass
- CWE-324
<0.14.3 · fixed in 0.14.3
GHSA-5c3f-6486-3g7g · CVE-2026-52809 - CVSS 9.2 CriticalCritical · CVSS 9+
OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
- CWE-324
- CWE-672
<2026.4.15 · fixed in 2026.4.15
GHSA-xmxx-7p24-h892 · CVE-2026-43585 - CVSS 5.3 Medium
IBM Sterling Partner Engagement Manager Information Disclosure
- IBM Sterling Partner Engagement Manager
- CWE-324
- CVSS 6.3 Medium
IBM Db2 improper account lockout
- IBM Db2
- CWE-324
- CVSS 6.3 Medium
Virtual Secure Mode Spoofing Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- CWE-324
- CVSS 2.3 Low
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token
- Authentication bypass
- CWE-324
<2.23.0 · fixed in 2.23.0
GHSA-3rw9-wmc8-8948 · CVE-2025-71435 - CVSS 4.1 Medium
Shim: expired secure boot certificate
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- CWE-324
- CVSS 8.1 High
PgBouncer default auth_query does not take Postgres password expiry into account
- PgBouncer
- CWE-324
- CVSS 8.7 High
Zitadel Expired JWT Keys Usable for Authorization Grants
- zitadel
- CWE-324
- CVSS 4.8 Medium
Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity
- CWE-324
<24.0.7 || >=25.0.0, <25.0.4 · fixed in 24.0.7, 25.0.4
GHSA-xmmm-jw76-q7vg · CVE-2024-7318 - CVSS 4.8 Medium
Duplicate Advisory: Keycloak Uses a Key Past its Expiration Date
- CWE-324
<24.0.7 · fixed in 24.0.7
GHSA-57rh-gr4v-j5f6 - CVSS 4.8 Medium
Use of a Key Past its Expiration Date in Conduit
- Conduit
- CWE-324
- CVSS 6.5 Medium
Moodle uses the same key for QR login and auto-login
- Weak cryptography or TLS
- CWE-324
<4.1.11 || >=4.2.0-beta, <4.2.8 || >=4.3.0-beta, <4.3.5 || >=4.4.0-beta, <4.4.1 · fixed in 4.1.11, 4.2.8, 4.3.5, 4.4.1
GHSA-r82w-3phg-qvr4 · CVE-2024-38277 - CVSS 9.8 CriticalCritical · CVSS 9+
keys: Fix overwrite of key expiration on instantiation
- Linux kernel
- CWE-324
- CVSS 4.3 Medium
IBM App Connect Enterprise information disclosure
- IBM App Connect Enterprise
- CWE-324
- CVSS 4.3 Medium
IBM App Connect Enterprise information disclosure
- IBM App Connect Enterprise
- CWE-324
- CVSS 4.3 Medium
IBM App Connect Enterprise information disclosure
- IBM App Connect Enterprise
- CWE-324
- CVSS 6.5 Medium
In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by sending a CONNECTION_CLOSE frame that is encrypted via the in…
- CWE-324
- CVSS 9.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Asus RT-AX82U: An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of…
- Asus RT-AX82U
- CWE-324
-
A flaw was found in Keystone.
- openstack-keystone
- CWE-324
- CVSS 9.8 CriticalCritical · CVSS 9+
Contao Does Not Expire Tokens Correctly
- Authentication bypass
- CWE-324
>=4.7.0, <4.7.3 · fixed in 4.7.3
GHSA-j99g-qjvx-995g · CVE-2019-10643 - CVSS 8.2 High
Philips Vue PACS Use of a Key Past its Expiration Date
- Philips Vue PACS
- Philips Vue MyVue
- CWE-324
- CVSS 6.3 Medium
Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server
- Authentication bypass
- CWE-324
<0.5.4 · fixed in 0.5.4
GHSA-6cp7-g972-w9m9 · CVE-2022-24732 - CVSS 6.1 Medium
Ops Manager uaa client issues tokens after refresh token expiration
- Pivotal Ops Manager
- CWE-324