Nagios XI <2024R1.1.3: Session Expiration Failure on Passwd Change
CVE-2024-13996 Published on October 30, 2025
Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change
Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow continued unauthorized access to user data and actions even after a password change.
Weakness Type
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Products Associated with CVE-2024-13996
stack.watch emails you whenever new vulnerabilities are published in Nagios Xi or Nagios Xi. Just hit a watch button to start following.
Affected Versions
Nagios XI:- Before 2024R1.1.3 is unknown.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.