CWE-324 · 25 records

Use of a Key Past its Expiration Date

CVEs in this class

25 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2024-36031No exploit	keys: Fix overwrite of key expiration on instantiationlinux · linux kernel · CWE-324 Pre-auth	Critical9.8	—	0.7%	May 30, 2024
39Monitor	CVE-2025-2291No exploit	PgBouncer default auth_query does not take Postgres password expiry into accountpgbouncer · pgbouncer · CWE-324 Pre-auth	Critical9.8	—	0.4%	Apr 16, 2025
38Monitor	CVE-2022-35401No exploit	An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230.asus · rt-ax82u firmware · CWE-324 Pre-auth Auth bypass	High8.1	—	20.8%	Jan 10, 2023
36Monitor	CVE-2026-39923No exploit	Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /resetflarum · flarum framework · CWE-324 Pre-auth	Critical9.2	—	0.4%	Aug 5, 2026
35Monitor	CVE-2022-24732No exploit	Maddy Mail Server does not implement account expirymaddy project · maddy · CWE-324	High8.8	—	0.4%	Mar 9, 2022
35Monitor	CVE-2025-33012No exploit	IBM Db2 improper account lockoutibm · db2 · CWE-324	High8.8	—	0.2%	Nov 7, 2025
34Monitor	CVE-2025-31123No exploit	Zitadel Expired JWT Keys Usable for Authorization Grantszitadel · zitadel · CWE-324	High8.7	—	0.4%	Mar 31, 2025
30Monitor	CVE-2021-33020No exploit	Philips Vue PACS Use of a Key Past its Expiration Datephilips · myvue · CWE-324 Pre-auth	High7.5	—	0.6%	Apr 1, 2022
30Monitor	CVE-2023-6960No exploit	TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion.sciener · ttlock app · CWE-324 Pre-auth	High7.5	—	0.3%	Mar 15, 2024
30Monitor	CVE-2025-13723No exploit	IBM Sterling Partner Engagement Manager Information Disclosureibm · sterling partner engagement manager · CWE-324 Pre-auth	High7.5	—	0.2%	Mar 13, 2026
27Monitor	CVE-2026-52809No exploit	Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVESgogs · gogs · CWE-324 Pre-auth	Medium6.8	—	0.2%	Jun 24, 2026
26Monitor	CVE-2022-2447No exploit	A flaw was found in Keystone.openstack · keystone · CWE-324	Medium6.6	—	0.7%	Sep 1, 2022
26Monitor	CVE-2024-31895No exploit	IBM App Connect Enterprise information disclosureibm · app connect enterprise · CWE-324	Medium6.5	—	0.3%	May 22, 2024
26Monitor	CVE-2024-25679No exploit	In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by sepquic · pquic · CWE-324 Pre-auth	Medium6.5	—	0.3%	Feb 9, 2024
21Monitor	CVE-2019-3790No exploit	Ops Manager uaa client issues tokens after refresh token expirationpivotal software · operations manager · CWE-324	Medium5.4	—	0.7%	Jun 6, 2019
21Monitor	CVE-2024-38277No exploit	moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keysmoodle · moodle · CWE-324	Medium5.4	—	0.2%	Jun 18, 2024
19Monitor	CVE-2024-7318No exploit	Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverityredhat · build of keycloak · CWE-324 Pre-auth	Medium4.8	—	0.4%	Sep 9, 2024
19Monitor	GHSA-57rh-gr4v-j5f6No exploit	Duplicate Advisory: Keycloak Uses a Key Past its Expiration DateMaven · org.keycloak:keycloak-core · CWE-324 Pre-auth	Medium4.8	—	—	Sep 9, 2024
18Monitor	CVE-2025-48813No exploit	Virtual Secure Mode Spoofing Vulnerabilitymicrosoft · windows 10 1809 · CWE-324	Medium4.7	—	0.3%	Oct 14, 2025
17Monitor	CVE-2024-31894No exploit	IBM App Connect Enterprise information disclosureibm · app connect enterprise · CWE-324	Medium4.3	—	0.3%	May 22, 2024
17Monitor	CVE-2024-31893No exploit	IBM App Connect Enterprise information disclosureibm · app connect enterprise · CWE-324	Medium4.3	—	0.3%	May 22, 2024
16Monitor	CVE-2023-5342No exploit	Shim: expired secure boot certificatered hat · red hat enterprise linux 10 · CWE-324	Medium4.1	—	0.1%	Aug 14, 2025
14Monitor	CVE-2024-6299No exploit	Use of a Key Past its Expiration Date in Conduitconduit · conduit · CWE-324 Pre-auth	Low3.7	—	0.2%	Jun 25, 2024
12Monitor	CVE-2026-54787No exploit	sigstore-go fails to check signature timestamps against a signing key's validity periodsigstore · sigstore-go · CWE-324	Low3.1	—	0.1%	Jul 31, 2026
10Monitor	GHSA-3rw9-wmc8-8948No exploit	Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh tokenGo · github.com/coder/coder/v2 · CWE-324	Low2.5	—	—	Aug 28, 2025

CVE-2024-36031
39Monitor
keys: Fix overwrite of key expiration on instantiation
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
linux · linux kernelMay 30, 2024
CVE-2025-2291
39Monitor
PgBouncer default auth_query does not take Postgres password expiry into account
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
pgbouncer · pgbouncerApr 16, 2025
CVE-2022-35401
38Monitor
An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230.
HighCVSS 8.1No exploitEPSS 21%
- Pre-auth
- Auth bypass
asus · rt-ax82u firmwareJan 10, 2023
CVE-2026-39923
36Monitor
Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
flarum · flarum frameworkAug 5, 2026
CVE-2022-24732
35Monitor
Maddy Mail Server does not implement account expiry
HighCVSS 8.8No exploitEPSS 0%
maddy project · maddyMar 9, 2022
CVE-2025-33012
35Monitor
IBM Db2 improper account lockout
HighCVSS 8.8No exploitEPSS 0%
ibm · db2Nov 7, 2025
CVE-2025-31123
34Monitor
Zitadel Expired JWT Keys Usable for Authorization Grants
HighCVSS 8.7No exploitEPSS 0%
zitadel · zitadelMar 31, 2025
CVE-2021-33020
30Monitor
Philips Vue PACS Use of a Key Past its Expiration Date
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
philips · myvueApr 1, 2022
CVE-2023-6960
30Monitor
TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
sciener · ttlock appMar 15, 2024
CVE-2025-13723
30Monitor
IBM Sterling Partner Engagement Manager Information Disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
ibm · sterling partner engagement managerMar 13, 2026
CVE-2026-52809
27Monitor
Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
MediumCVSS 6.8No exploitEPSS 0%
- Pre-auth
gogs · gogsJun 24, 2026
CVE-2022-2447
26Monitor
A flaw was found in Keystone.
MediumCVSS 6.6No exploitEPSS 1%
openstack · keystoneSep 1, 2022
CVE-2024-31895
26Monitor
IBM App Connect Enterprise information disclosure
MediumCVSS 6.5No exploitEPSS 0%
ibm · app connect enterpriseMay 22, 2024
CVE-2024-25679
26Monitor
In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by se
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
pquic · pquicFeb 9, 2024
CVE-2019-3790
21Monitor
Ops Manager uaa client issues tokens after refresh token expiration
MediumCVSS 5.4No exploitEPSS 1%
pivotal software · operations managerJun 6, 2019
CVE-2024-38277
21Monitor
moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys
MediumCVSS 5.4No exploitEPSS 0%
moodle · moodleJun 18, 2024
CVE-2024-7318
19Monitor
Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity
MediumCVSS 4.8No exploitEPSS 0%
- Pre-auth
redhat · build of keycloakSep 9, 2024
GHSA-57rh-gr4v-j5f6
19Monitor
Duplicate Advisory: Keycloak Uses a Key Past its Expiration Date
MediumCVSS 4.8No exploit
- Pre-auth
Maven · org.keycloak:keycloak-coreSep 9, 2024
CVE-2025-48813
18Monitor
Virtual Secure Mode Spoofing Vulnerability
MediumCVSS 4.7No exploitEPSS 0%
microsoft · windows 10 1809Oct 14, 2025
CVE-2024-31894
17Monitor
IBM App Connect Enterprise information disclosure
MediumCVSS 4.3No exploitEPSS 0%
ibm · app connect enterpriseMay 22, 2024
CVE-2024-31893
17Monitor
IBM App Connect Enterprise information disclosure
MediumCVSS 4.3No exploitEPSS 0%
ibm · app connect enterpriseMay 22, 2024
CVE-2023-5342
16Monitor
Shim: expired secure boot certificate
MediumCVSS 4.1No exploitEPSS 0%
red hat · red hat enterprise linux 10Aug 14, 2025
CVE-2024-6299
14Monitor
Use of a Key Past its Expiration Date in Conduit
LowCVSS 3.7No exploitEPSS 0%
- Pre-auth
conduit · conduitJun 25, 2024
CVE-2026-54787
12Monitor
sigstore-go fails to check signature timestamps against a signing key's validity period
LowCVSS 3.1No exploitEPSS 0%
sigstore · sigstore-goJul 31, 2026
GHSA-3rw9-wmc8-8948
10Monitor
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token
LowCVSS 2.5No exploit
Go · github.com/coder/coder/v2Aug 28, 2025

All vulnerability classes