Use of a Key Past its Expiration Date
CWE-324
The product uses a cryptographic key past its expiration date.
We track 8 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Architecture and Design: Adequate consideration should be put into the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.
- Implementation: Replace keys within a period of time proportional to their strength.
Latest Use of a Key Past its Expiration Date vulnerabilities
- 8.1 High severity
Flarum Framework: Use of a Key Past its Expiration Date
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() met
- 7.5 High severity
Sterling Partner Engagement Manager: Use of a Key Past its Expiration Date
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token
- 8.8 High severity
Db2: Use of a Key Past its Expiration Date
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date.
- 9.8 Critical severity
PgBouncer: Use of a Key Past its Expiration Date
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
- 8.7 High severity
zitadel: Use of a Key Past its Expiration Date
Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows
- 9.8 Critical severity
Linux: Use of a Key Past its Expiration Date
In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for
- 8.1 High severity
RT-AX82U: Improper Authentication
An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series o
- 8.8 High severity
maddy: Use of a Key Past its Expiration Date
Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually