@workos-inc/authkit-nextjs session replay vulnerability · CVE-2024-29901 · GitHub Advisory Database · GitHub

@workos-inc/authkit-nextjs session replay vulnerability

Moderate severity GitHub Reviewed Published Mar 28, 2024 in workos/authkit-nextjs • Updated Mar 29, 2024

Package

@workos-inc/authkit-nextjs (npm)

Affected versions

< 0.4.2

Patched versions

0.4.2

Description

Impact

A user can reuse an expired session by controlling the x-workos-session header.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2

References

cmatheson published to workos/authkit-nextjs

Mar 28, 2024

Published by the National Vulnerability Database

Mar 29, 2024

Published to the GitHub Advisory Database Mar 29, 2024

Reviewed Mar 29, 2024

Last updated Mar 29, 2024

Severity

Moderate

4.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N