Common Weakness Enumeration

    CWE Definition / CWE-613

    CWE-613: Insufficient Session Expiration

    According to WASC, Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.

    Published:7 May 2007
    Organization:MITRE
    Modified:30 Apr 2026

    Related Weakness

    CWE-672: Operation on a Resource after Expiration or Release

    CWE-672: Operation on a Resource after Expiration or Release

    CWE-287: Improper Authentication