{"id":"CVE-2021-25940","details":"In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.","aliases":["BIT-arangodb-2021-25940"],"modified":"2026-07-09T01:30:19.590958Z","published":"2021-11-16T10:15:06.783Z","references":[{"type":"ADVISORY","url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25940"},{"type":"FIX","url":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/arangodb/arangodb","events":[{"introduced":"780ac0e1272d8fcebe2ed36c0e2cbaf336f0d207"},{"last_affected":"7a9a07d06a0d9750103c93eb3caa9eda8e782b72"},{"fixed":"e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3"}],"database_specific":{"cpe":"cpe:2.3:a:arangodb:arangodb:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.7.6"},{"last_affected":"3.8.3"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25940.json","vanir_signatures_modified":"2026-07-09T01:30:19Z","vanir_signatures":[{"digest":{"function_hash":"304800437640291846173093504186472095577","length":1098},"id":"CVE-2021-25940-0a984027","signature_type":"Function","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/GeneralServer/AuthenticationFeature.cpp","function":"AuthenticationFeature::validateOptions"},"deprecated":false},{"source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/GeneralServer/AuthenticationFeature.cpp","function":"AuthenticationFeature::AuthenticationFeature"},"deprecated":false,"digest":{"function_hash":"115735212466459881212953764144459330578","length":485},"id":"CVE-2021-25940-10908c80","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/RestHandler/RestAuthHandler.cpp","function":"RestAuthHandler::execute"},"deprecated":false,"digest":{"function_hash":"273544426006471626020236115299434825323","length":1341},"id":"CVE-2021-25940-1af10564"},{"id":"CVE-2021-25940-3344dfc9","signature_type":"Function","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/RestHandler/RestAuthHandler.cpp","function":"RestAuthHandler::generateJwt"},"deprecated":false,"digest":{"function_hash":"229188304507844909734213675151876473963","length":260}},{"target":{"file":"arangod/RestServer/ServerFeature.cpp"},"deprecated":false,"digest":{"line_hashes":["328553511293069189768722403529806082329","225529178908766150895038135837370517111","236155253539082183724193596441387013242","43142061527095832807866863797149231898","288138357586781847598790344784782817071","103070741936585817423478001244098433458"],"threshold":0.9},"id":"CVE-2021-25940-4210db08","signature_type":"Line","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3"},{"source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/GeneralServer/AuthenticationFeature.h"},"deprecated":false,"digest":{"line_hashes":["143853262848751300930142644553398690134","13035545588251594659876395381765867164","97637096598696511979806924630437293674","82394036246963043946152460695910161802","216958682832948010005855965122418211273","264045976651746836786442095450694448537","185103051763343416843302227542526670281","159623293290879430750406638239461622664"],"threshold":0.9},"id":"CVE-2021-25940-4dd70dc0","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"99090291792254957906027673325043506677","length":173},"id":"CVE-2021-25940-4f2dfefa","signature_type":"Function","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/RestHandler/RestAuthHandler.cpp","function":"RestAuthHandler::RestAuthHandler"}},{"id":"CVE-2021-25940-8076747c","signature_type":"Function","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/GeneralServer/AuthenticationFeature.cpp","function":"AuthenticationFeature::collectOptions"},"deprecated":false,"digest":{"function_hash":"192459769600878105954316520604499287850","length":2416}},{"deprecated":false,"digest":{"line_hashes":["287297942701168654610215303181176069198","306494882007545031490796006946966498945","129704257855367874537474155697429936856","228956524541850776954690409025204929442","294382858837526290125265233430065342220","139373389276337751674714888882099117317","11889462672212475404069884648390319747","173865336129245312378389982221131363407","295693872904889735790517770190232748359","266199106604296587712362992592806594081","308513015529135791975569327523887330345","82849190108251473942239984166533417409","172374198763802874918504974053682900815","331945458815691371884589939600520680759"],"threshold":0.9},"id":"CVE-2021-25940-9a3afa26","signature_type":"Line","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/RestHandler/RestAuthHandler.h"}},{"source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/GeneralServer/AuthenticationFeature.cpp"},"deprecated":false,"digest":{"line_hashes":["79328136048882573227252672617144648352","244134932945733128016667887026204142884","321799975332290222917454827276947056898","265689975584019371037076287186544599885","51333797349810219641389700653240188124","174437070251538467239003476613906274420","181522884266420468766876519630255532371","84958180090828878451776314782394968931","266853716709107843097966241186106361335","103029892223586412750669333114348145801","148843508972248920915724874454737136625","252337413757552132367934006693423096787","207619578819084224346085055597739353582","180015120083593638867027385392093988655","235558977946020490837875220908457684566","51642613513204236067133277526291224992","45574367845575127784621387587265431459","208310287664802018930757557443255697501","299365956591001078664669089510006665634","312391991642040251740395633812407416760"],"threshold":0.9},"id":"CVE-2021-25940-aa85805e","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/RestServer/ServerFeature.cpp","function":"ServerFeature::collectOptions"},"deprecated":false,"digest":{"function_hash":"83995709477569495558343989341557358107","length":3193},"id":"CVE-2021-25940-dcfc7dd1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3","target":{"file":"arangod/RestHandler/RestAuthHandler.cpp"},"deprecated":false,"digest":{"line_hashes":["72143599975647758205041190846203830817","268878553174630995726422467510481811722","15327311104489165736435584654807599156","297526232182721196080019898624338900412","44562774631215512704796596841857246752","96124678772701660438100705325154857956","49640005359816997140898376763235261025","329549829609198953195887259744650941690","54858387964015271339351867816990174233","265180257754725505186843532237069177484","124185374382997601268039581383331045242","4969162760864723626249771314500130813","282073209321194583392320660286883581081","316274092295021211429334185504900006331","233084969207673586395738717246206033682","131057628350367031785458574620290482766","271061772793429856086625455715755282388","228590353621593390184064457588483185765","307011325034686762590672458877722987652","127296718383405503661605210042026102972","326986114122549879195839513264475364325","80810441527854772686314301540177322784","285492120017334426823018014249174322781","39255561044666126401026899809305440132","335472220061306775713610076072502911385","125302074033288131580235047764304492336","262526177474797784273613212940907712635","237299637982840625712529859820513910898","84256029836598607573782140633818946566","321907700127820617728331162860613103063","141323342926187059829561541388171183906","51186309606698884078211981034910942797","51328903576828150518681674779509539141","248766599689987862617085558503533771862","208410085272193673156392765311956081633","313794831755240059960975584960776566837","323259054468361846776244656380824747217","109129302156811383701503410979288528033","37424328475260355057426627749075538702","90086131444520089939092105753790058940","155804269568443524508603418087292422876","173432867680748241170863453000868297822","244424452309230988325213522449821953237","300126745303181467991767553168180393480","321592974795382592206626033427636510459","89373241001486597927023045376681600090","296641698798571184815692779047673078445","146462311646668389936897787117451502200","305992666220972118922637306896260609550","91423013395630638555707541529252860789","306859510452713931862509122242191725898","126723750210171113776506641609462852832","265831143253960609744514335942360987380","240261187519911961558381529659906322748"],"threshold":0.9},"id":"CVE-2021-25940-e4861223"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}