Insufficient session expiration in Truesec LAPSWebUI before version 2.4 allows a user with access to a workstation to maintain a long‑lived session and view the local administrator password. This flaw falls under the CWE‑613 category and can lead to privilege escalation, granting an attacker the ability to perform actions with local admin rights.

Organisations using Truesec LAPSWebUI on versions earlier than 2.4 are impacted. The vulnerability affects the LAPSWebUI component across all deployments that have not applied the recent update.

The CVSS score of 6.0 indicates a moderate severity, and the EPSS score of less than 1 % suggests low exploitation probability under current conditions. The vulnerability is not listed in CISA’s KEV catalog, reflecting limited known exploitation. Since the flaw requires local access to a workstation and relies on session lifetime settings, it can be mitigated by enforcing re‑authentication or by applying the vendor‑issued update that removes the long‑lived session behaviour.