CVE-2024-13996

Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow continued unauthorized access to user data and actions even after a password change.

• CWE-613

• https://www.nagios.com/changelog/nagios-xi/Release Notes
• https://www.nagios.com/products/security/#nagios-xiVendor Advisory
• https://www.vulncheck.com/advisories/nagios-xi-session-not-invalidated-after-password-changeThird Party Advisory

Published

Oct 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13990MicroWorld eScan AV's update mechanism failed to ensure auth…9.3
• CVE-2024-13991Huijietong Cloud Video Platform contains a path traversal vu…8.7
• CVE-2024-13992Nagios XI versions prior to < 2024R1.1 is vulnerable to a cr…5.4
• CVE-2024-13993Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a…6.1
• CVE-2024-13994Nagios XI versions prior to 2024R1.1.2 contain a missing aut…9.8
• CVE-2024-13995Nagios XI versions prior to 2024R1.1.2 may (confirmed in 202…8.8
• CVE-2024-13997Nagios XI versions prior to 2024R1.1.3 contain a privilege e…7.2
• CVE-2024-13998Nagios XI versions prior to 2024R1.1.3, under certain circum…6.5
• CVE-2024-13999Nagios XI versions prior to 2024R1.1.3, under certain circum…9.8
• CVE-2024-1400The Mollie Forms plugin for WordPress is vulnerable to unaut…4.3
• CVE-2024-14000Nagios XI versions prior to 2024R1.1.3 are vulnerable to cro…5.4
• CVE-2024-14001Nagios XI versions prior to 2024R1.1.3 are vulnerable to cro…5.4