CWE-1472
Generation of Credential with Long Expiration
2026-10-28
00h00 +00:00
00h00 +00:00
Incomplete
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Generation of Credential with Long Expiration
The product generates or relies on a credential such as a key,
certificate, password, confirmation code, or token, but the credential
does not expire or has an expiration that is too long, i.e., the
expiration is insufficient for the intended security policy of the
product.
Thông tin chung
Các cách xuất hiện
ImplementationSystem Configuration
Operation
Nền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Kiến trúc
Lớp: Not Architecture-Specific (Undetermined)Công nghệ
Lớp: Not Technology-Specific (Undetermined)Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Access Control Confidentiality Integrity | Gain Privileges or Assume Identity, Bypass Protection Mechanism, Varies by Context |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2026-96616 | Video encoder web interface issues authentication tokens with an expiration time that is longer than the expected session lifetime. |
CVE-2026-33707 | Chain: Learning management system generates tokens without an expiration (CWE-1472), making its password reset mechanism weak (CWE-640). |
CVE-2026-26342 | firmware camera system creates an authentication token with insufficient expiration. |
CVE-2026-21622 | Package manager for Erlang uses password reset tokens that do not expire. |
CVE-2026-8760 | Wordpress plugin generates a One-Time Password (OTP) without an expiration (CWE-1472) and does not perform rate-limiting (CWE-307), allowing attackers to compromise accounts via a brute force attack. |
Các biện pháp giảm thiểu tiềm năng
Phases : Implementation // OperationPhases : Architecture and Design
Phương pháp phát hiện
Automated Dynamic Analysis
Manual Analysis
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Tài liệu tham khảo
REF-1564
Antipattern: Set a long expiration time for OAuth tokensGoogle.
https://docs.cloud.google.com/apigee/docs/api-platform/antipatterns/oauth-long-expiration
REF-1578
NIST IR 8587: Protecting Tokens and Assertions from Forgery, Theft, and MisuseNIST.
https://doi.org/10.6028/NIST.IR.8587
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 5.0 |
