CWE-1469 Improper Check for Credential Expiration

The product receives a request that includes a credential such as a key, certificate, password, confirmation code, or token, but the product does not check whether the credential is expired.

• Access Control, Confidentiality, Integrity: Gain Privileges or Assume Identity, Bypass Protection Mechanism — The consequences vary depending on how the credential is intended for use within the product. If an attacker steals or guesses the expired credential, then the attacker would have more time than desired in order to conduct malicious activities.

• [Implementation] When receiving a credential, look up its expiration to ensure that the credential is still active. If the incoming credential states its own expiration, do not trust this value as it may be part of untrusted input. • [Architecture and Design] Ensure that, for any flow that generates or resets credentials, the expiration is clearly recorded for the credential. Also, ensure that mechanisms exist (such as error handling) for implementations to easily check for expiration, or build in the expiration check as part of the design.

• CVE-2024-8642: Data-sharing product does not check token properties including expiry, allowing attackers to bypass the expiration check. • CVE-2023-48220: Product does not ensure that a pending invitation is processed before the specified expiry period. • CVE-2026-66400: Chain: product compares an array to a scalar value (CWE-1024), effectively bypassing an expiry check for a token (CWE-xxxx). • CVE-2026-67242: Product checks expiry for integer values, but not for floats.