CWE-1472 Generation of Credential with Long Expiration

The product generates or relies on a credential such as a key, certificate, password, confirmation code, or token, but the credential does not expire or has an expiration that is too long, i.e., the expiration is insufficient for the intended security policy of the product.

• Access Control, Confidentiality, Integrity: Gain Privileges or Assume Identity, Bypass Protection Mechanism, Varies by Context — The consequences vary depending on how the credential is intended for use within the product. At the least, a long expiration date gives an attacker more time to steal or guess the credential, and if compromised, the attacker would have more time than desired in order to conduct malicious activities.

• [Implementation, Operation] For each credential that is created, reset, or used, ensure that the expiration is set to be as short as possible while preserving usability. • [Architecture and Design] Design the product to analyze the credentials that it manages, and provide mechanisms to provide secure defaults, and/or a capability to warn users about excessive expiration.

• Automated Dynamic Analysis: If the credentials are provided through a communications protocol, monitor the communications related to credential generation and examine any expiration dates or times that are set. • Manual Analysis: Examine the code to determine where credentials are created or updated, and determine how any expiration dates or times are set.

• CVE-2026-96616: Video encoder web interface issues authentication tokens with an expiration time that is longer than the expected session lifetime. • CVE-2026-33707: Chain: Learning management system generates tokens without an expiration (CWE-1472), making its password reset mechanism weak (CWE-640). • CVE-2026-26342: firmware camera system creates an authentication token with insufficient expiration. • CVE-2026-21622: Package manager for Erlang uses password reset tokens that do not expire. • CVE-2026-8760: Wordpress plugin generates a One-Time Password (OTP) without an expiration (CWE-1472) and does not perform rate-limiting (CWE-307), allowing attackers to compromise accounts via a brute force attack.