CWEweakness
CWE-324 Use of a Key Past its Expiration Date
Low
Official page ↗
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Likelihood of exploit
- Low
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product uses a cryptographic key past its expiration date.
Common consequences
• Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity — Using a key past its expiration data increases the timing window for cracking attacks against that key. Or, the key in question may be compromised, providing a malicious user with a method for authenticating as the victim.
Potential mitigations
• [Architecture and Design] Adequate consideration should be put into the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.
• [Implementation] Replace keys within a period of time proportional to their strength.
Observed examples
• CVE-2021-33020: Picture Archiving and Communication System (PACS) system for hospitals uses a cryptographic key or password past its expiration date
Related
Observed example · CVE (1)
- CVE-2021-33020 Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety… vulnerability
Child of · CWE (1)
- CWE-672 Operation on a Resource after Expiration or Release weakness
Peer of · CWE (1)
- CWE-298 Improper Validation of Certificate Expiration weakness
Referenced by CVE · weakness (22)
- CVE-2026-39923 Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired… vulnerability
- CVE-2026-54787 sigstore-go is a Go library for Sigstore signing and verification. vulnerability
- CVE-2026-52809 Gogs is an open source self-hosted Git service. vulnerability
- CVE-2025-13723 IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive… vulnerability
- CVE-2025-33012 IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an… vulnerability
- CVE-2025-48813 Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally. vulnerability
- CVE-2023-5342 The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components… vulnerability
- CVE-2025-2291 Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an… vulnerability
- CVE-2025-31123 Zitadel is open-source identity infrastructure software. vulnerability
- CVE-2024-7318 A vulnerability was found in Keycloak. vulnerability
- CVE-2024-6299 Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to… vulnerability
- CVE-2024-38277 A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between… vulnerability
- CVE-2024-36031 In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time… vulnerability
- CVE-2024-31893 IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an… vulnerability
- CVE-2024-31894 IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an… vulnerability
- CVE-2024-31895 IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an… vulnerability
- CVE-2024-25679 In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by… vulnerability
- CVE-2022-35401 An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. vulnerability
- CVE-2022-2447 A flaw was found in Keystone. vulnerability
- CVE-2021-33020 Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety… vulnerability
- CVE-2022-24732 Maddy Mail Server is an open source SMTP compatible email server. vulnerability
- CVE-2019-3790 The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions… vulnerability
Referenced by CWE · peer of (1)
- CWE-262 Not Using Password Aging weakness