CVE-2026-44394: Missing Token Expiry Propagationcve-2026-44394-missing-token-expiry-propagation
When rescoping or mapping a new session context from an existing token, the original token's expiration time is not explicitly preserved. Failing to propagate the `expires_at` property can allow an attacker to indefinitely extend session lifetimes by repeatedly rescoping tokens before their explicit expiration.
