CVE-2025-71435
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token exp
CVSS
4.2
Medium
EPSS
0.2%
p7
KEV
—
Exploit Today
2
0-100
Published: Oct 17, 2026 · Last modified: Oct 19, 2026 · CWE-613
0.2%EPSS · 30 days0.2%
2026-10-182026-10-20
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-362526.3 MED4.1%
——1IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system.1dCVE-2025-360695.5 MED1.6%
——0IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.1dCVE-2025-131736.5 MED3.7%
——1Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.
This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.22hCVE-2026-12254—14.1%
——4Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via the Captive Portal using a rogue access point to either access malicious sites or exfiltrate data.The issue impacts all versions prior to R14222hCVE-2026-1100084.2 MED0.6%
——0@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the original cookies survive the callback and the documented single-use guarantee for the state value does not hold. A state value an attacker learns stays valid for the rest of the browser session, letting the attacker drive their own authorization flow in the victim's browser and sign the victim in to the attacker's account (login CSRF). The issue is fixed in @fastify/oauth2 8.3.2, and users should upgrade to 8.3.2 or later. As a workaround, set an explicit cookie path so the set and the clear name the same cookie.2dCVE-2026-79624—9.8%
——3Insufficient session expiration vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.2d