Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Directly accessing `ExpiresAt.Time` on JWT claims without checking if `ExpiresAt` is nil causes a nil pointer dereference panic for tokens without an expiration (`exp`) claim. This can crash revocation and logout handlers, allowing tokens to remain valid.
OAuth token generation expands repository scopes without filtering unaffiliated organization scopes against current user memberships, allowing revoked organization members to maintain access via token refresh grants.
Handling expired JWT tokens (`jwt.ErrTokenExpired`) by unconditionally returning `true` without verifying HTTP request headers or proxy identity assertions allows attackers with expired tokens to bypass authentication.
Missing expiration time validation for a retrieved token, reducing the effectiveness of short-lived tokens and potentially enabling brute-force attacks.
Agent auth token expiration is hardcoded instead of using configured session duration.
Recreating a session token without explicitly deleting the previous session from the token store can result in insufficient session expiration. Orphaned session identifiers may remain fully privileged, allowing session hijacking. Ensure the old session is deleted (e.g., typically via `$TOKEN.del()`) before generating and assigning a new one.
Generating an activation token instead of a password reset token may grant an attacker a much longer window to exploit hijacked reset links. Password reset tokens should have a distinct, shorter lifetime than generic account activation tokens.
Authentication or session cookies are deleted before making a fetch request to a server endpoint. This causes the request to be sent unauthenticated, which can fail backend session revocation.
When rescoping or mapping a new session context from an existing token, the original token's expiration time is not explicitly preserved. Failing to propagate the `expires_at` property can allow an attacker to indefinitely extend session lifetimes by repeatedly rescoping tokens before their explicit expiration.
OIDC configurations do not enforce session invalidation on token expiration. This allows an authenticated session to persist indefinitely. Configure `logoutWhenIdTokenIsExpired(true)` on the `OpenIdConfiguration.Builder`.
This function validates a password-reset / token record by comparing `$RESET.key` for plain equality without verifying the record's age or using a constant-time comparison. Reset tokens that never expire allow account takeover when an attacker obtains a previously issued (unused) reset email — e.g., from a leaked mailbox archive (CWE-613). Enforce an expirat
Logout handler does not regenerate or destroy the PHP session ID. Clearing application-level authentication state without rotating the session identifier leaves the session cookie valid after logout, enabling session hijacking and session-fixation attacks (CWE-613). Add a call to session_regenerate_id(true), session_destroy(), or an equivalent session-ID rot
The configured token revocation action for AshAuthentication lacks a `:boolean` return type or explicitly disallows missing inputs with `allow_nil?: false`. This flawed action configuration fails to process token input gracefully, allowing revoked tokens to evade revocation checks and continue authenticating users. To fix this, specify `:boolean` as the retu
A client-side logout/signout function was found that clears local storage or session storage but does not clear `document.cookie`. If the application relies on cookies for certain features or authentication (such as a separate dashboard token), failing to clear them during logout can allow subsequent users on shared devices to reuse the hijacked session. Ver
A custom session handler implements the `read` method using database queries without checking the session's expiration time. PHP's internal garbage collection (`gc`) is only called probabilistically based on `session.gc_probability` and `session.gc_divisor`. Consequently, expired sessions remain in the data store for an unpredictable amount of time, allowing
'Session middleware settings: `maxAge` not set. Use it to set expiration date for cookies.'
JSCWE-613
