The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
While the expiration of keys does not necessarily ensure that they are compromised, it is a significant concern that keys which remain in use for prolonged periods of time have a decreasing probability of integrity. For this reason, it is important to replace keys within a period of time proportional to their strength.

Primary

Resultant

Architecture and Design
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Low

Access Control
Bypass Protection Mechanism
Gain Privileges or Assume Identity
The cryptographic key in question may be compromised, providing a malicious user with a method for authenticating as the victim.

Architecture and Design
Adequate consideration should be put in to the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.

The following code attempts to verify that a certificate is valid.

if (cert = SSL_get_peer_certificate(ssl)) {
foo=SSL_get_verify_result(ssl);if ((X509_V_OK==foo) || (X509_V_ERRCERT_NOT_YET_VALID==foo))

//do stuff

}

The code checks if the certificate is not yet valid, but it fails to check if a certificate is past its expiration date, thus treating expired certificates as valid.

CVE-2021-33020
Picture Archiving and Communication System (PACS) system for hospitals uses a cryptographic key or password past its expiration date
https://www.cve.org/CVERecord?id=CVE-2021-33020

Using a key past its expiration date

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CLASP
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Demonstrative_Examples

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2013-02-21
updated Applicable_Platforms, Demonstrative_Examples, Description, Other_Notes

CWE Content Team
MITRE
2014-07-30
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2017-11-08
updated Demonstrative_Examples, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2021-03-15
updated References

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities

Using a Key Past its Expiration Date