CWE · MITRE source
CWE-613Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Last updated: 20 August 2026 13:14 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A07:2025 Authentication Failures.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls that address this weakness (8)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
AC-11 | Device Lock | AC | Locks the device (typically after inactivity) until re-authentication, addressing insufficient session expiration by preventing indefinite access. |
AC-12 | Session Termination | AC | Automatically terminating sessions after a defined period directly enforces session expiration, preventing indefinite session lifetimes that attackers can exploit. |
SC-10 | Network Disconnect | SC | Directly enforces termination of network sessions after inactivity or end-of-session, preventing indefinite session lifetime. |
SC-45 | System Time Synchronization | SC | Consistent clocks across systems allow session expiration and timeout enforcement to function as intended in distributed environments. |
SI-14 | Non-persistence | SI | When the non-persistent artifact is a session or connection, mandatory termination implements the missing expiration that CWE-613 describes. |
SI-21 | Information Refresh | SI | Timed refresh of session-related information or on-demand generation plus deletion implements proper session expiration. |
IA-11 | Re-authentication | IA | Re-authentication after inactivity or time-based triggers prevents indefinite use of potentially hijacked or stale sessions. |
MA-4 | Nonlocal Maintenance | MA | Terminating sessions and network connections upon completion prevents insufficient session expiration. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2014-2595 UPD | 8.4 | 9.8 | 0.1687 | 2020-02-12 |
CVE-2020-27422 UPD | 8.1 | 9.8 | 0.0786 | 2020-11-16 |
CVE-2016-6545 UPD | 7.8 | 9.8 | 0.0306 | 2018-07-13 |
CVE-2020-8234 UPD | 7.8 | 9.8 | 0.0341 | 2020-08-21 |
CVE-2020-29667 UPD | 7.8 | 9.8 | 0.0319 | 2020-12-10 |
CVE-2021-3311 UPD | 7.8 | 9.8 | 0.0290 | 2021-02-05 |
CVE-2018-21018 UPD | 7.7 | 9.8 | 0.0256 | 2019-09-22 |
CVE-2016-11014 UPD | 7.7 | 9.8 | 0.0254 | 2019-10-16 |
CVE-2019-8149 UPD | 7.7 | 9.8 | 0.0214 | 2019-11-06 |
CVE-2020-35358 UPD | 7.7 | 9.8 | 0.0243 | 2021-03-15 |
CVE-2021-25981 UPD | 7.7 | 9.8 | 0.0246 | 2022-01-03 |
CVE-2016-5069 UPD | 7.6 | 9.8 | 0.0135 | 2017-04-10 |
CVE-2018-6634 UPD | 7.6 | 9.8 | 0.0146 | 2019-05-07 |
CVE-2020-27739 UPD | 7.6 | 9.8 | 0.0184 | 2020-10-28 |
CVE-2020-6649 UPD | 7.6 | 9.8 | 0.0152 | 2021-02-08 |
CVE-2021-37333 UPD | 7.6 | 9.8 | 0.0147 | 2021-10-04 |
CVE-2021-38823 UPD | 7.6 | 9.8 | 0.0150 | 2021-10-04 |
CVE-2021-40849 UPD | 7.6 | 9.8 | 0.0131 | 2021-11-03 |
CVE-2020-27416 UPD | 7.6 | 9.8 | 0.0159 | 2021-12-08 |
CVE-2021-25992 UPD | 7.6 | 9.8 | 0.0160 | 2022-02-10 |
CVE-2015-5171 UPD | 7.5 | 9.8 | 0.0117 | 2017-10-24 |
CVE-2020-17474 UPD | 7.5 | 9.8 | 0.0118 | 2020-08-14 |
CVE-2021-3144 UPD | 7.5 | 9.1 | 0.0524 | 2021-02-27 |
CVE-2021-25979 UPD | 7.5 | 9.8 | 0.0110 | 2021-11-08 |
CVE-2021-22820 UPD | 7.5 | 9.8 | 0.0108 | 2022-01-28 |