We use form tokens. Those form tokens prevent spoof attacks. Also know as a CSRF token. Those tokens are provided entirely by Joomla's API. When the login form is rendered it generates one. On login it validates the token. The token is stored in your Joomla session. Now onto how this can fail. There are a few ways as follows.

1. Caching. If the module or page is cached the cache will serve an expired token. We'll be looking into ways to avoid this by loading in the token via JS after the page loads, but for now caching can cause a big problem for form tokens as it would anywhere that depends on form tokens.
2. Joomla session was tampered with. This can happen when an extension messes with the Joomla session during the login process.
3. Joomla session expired. This can happen if you visit the site, walk away for awhile, and come back to login. If the session expires during the login process the token is no longer valid (because it no longer exists).

Usually it's caused by 1 or 2. If you've no caching configured then it's probably 2, which is fixed by increasing your session time (setting this to 24 hours is usually a good approach).

An additional note for 2 Joomla has a keepalive script that'll keep refreshing the token behind the scenes and will review adding that. This should then avoid sessions expiring on pages with a form.

Have created a bug ticket to always load in Joomla's keepalive js when we output a form token. This will at least solve the issue of tokens expiring while the user is still on the site.

forge.joomlapolis.com/issues/9223

I don't have a solution for caching as that needs to be handled on a case by case basis by whatever caching method you're using. As for session tampering there's nothing I can do about that.

Once the fix is reviewed and merged will release a new CB build release with the fix.

Latest CB build release implemented support for Joomla's keepalive for any HTML output form token within CB. This should avoid sessions expiring on any page where a form token is output. Please let me know if your issue persists.