CWE-1463 Insufficient Session Timeout Value

The product establishes an authenticated user session, but it does not properly set a timeout for the session. That is, the timeout is set to an excessively large value or is not set at all.

• Access Control, Integrity: Gain Privileges or Assume Identity — This weakness may improve the likely success of certain attacks. For example, an attacker may intercept a session ID, possibly via a network sniffer or Cross-site Scripting attack. Although short session expiration times do not help if a stolen token is immediately used, they will protect against ongoing replaying of the session ID. In another scenario, a user might access a web site from a shared computer (such as at a library, Internet cafe, or open work environment), but forget to close the pages before leaving. A long expiration could allow an attacker to use the browser's back button to access web pages previously accessed by the victim.

• [Implementation] Ensure that user sessions have appropriate absolute timeouts set. The industry standard is between 4 and 8 hours for an absolute timeout [REF-1540]. • [Implementation] Ensure that user sessions have appropriate inactivity timeouts set. 2 to 5 minutes is recommended for high-value applications, and 15-30 minutes for low-risk applications [REF-1540]. • [Implementation] If using an authentication token for a user session, ensure that the token lifetime is configured based on the recommended best practices from the token provider [REF-1563]. There are situations using authentication tokens such as a JWT (Java Web Token) in which the server-side does not handle session timeouts and trusts the values directly from the token. In this case, it is important that the timeout value is set correctly for the token that is granted.

• CVE-2026-107275: Bad JWT expiration • CVE-2025-46344: JavaScript SDK does not set an expiration time for JWE tokens related to a session • CVE-2024-8888: Web interface for a power quality analyzer uses tokens without an expiration date • CVE-2024-35206: network traffic analyzer for PROFINET networks does not expire sessions • CVE-2024-27782: AI/ML monitor for IT operations allows re-use of old session tokens due to insufficient session expiration • CVE-2020-6291: No absolute session expiration