이름: Generation of Credential with Long Expiration

The product generates or relies on a credential such as a key, certificate, password, confirmation code, or token, but the credential does not expire or has an expiration that is too long, i.e., the expiration is insufficient for the intended security policy of the product.

일반 정보

취약점 도입 방식

Implementation
System Configuration
Operation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

아키텍처

클래스: Not Architecture-Specific (Undetermined)

기술

클래스: Not Technology-Specific (Undetermined)

일반적인 결과

범위	영향	가능성
Access Control Confidentiality Integrity	Gain Privileges or Assume Identity, Bypass Protection Mechanism, Varies by Context

관찰된 예시

참고 자료	설명
CVE-2026-96616	Video encoder web interface issues authentication tokens with an expiration time that is longer than the expected session lifetime.
CVE-2026-33707	Chain: Learning management system generates tokens without an expiration (CWE-1472), making its password reset mechanism weak (CWE-640).
CVE-2026-26342	firmware camera system creates an authentication token with insufficient expiration.
CVE-2026-21622	Package manager for Erlang uses password reset tokens that do not expire.
CVE-2026-8760	Wordpress plugin generates a One-Time Password (OTP) without an expiration (CWE-1472) and does not perform rate-limiting (CWE-307), allowing attackers to compromise accounts via a brute force attack.

잠재적 완화 방법

Phases : Implementation // Operation
Phases : Architecture and Design

탐지 방법

Automated Dynamic Analysis

Manual Analysis

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

참고 자료

REF-1564

Antipattern: Set a long expiration time for OAuth tokens
Google.
https://docs.cloud.google.com/apigee/docs/api-platform/antipatterns/oauth-long-expiration

REF-1578

NIST IR 8587: Protecting Tokens and Assertions from Forgery, Theft, and Misuse
NIST.
https://doi.org/10.6028/NIST.IR.8587

제출

이름	조직	날짜	출시일	Version
CWE Content Team	MITRE	2026-10-26 +00:00	2026-10-28 +00:00	5.0

CWE-1472 상세 정보

CWE-1472