CVE-2024-29901

2024-03-2916:15:08

CWE-294

[email protected]

web.nvd.nist.gov

authkit

next.js

authentication

session management

workos

vulnerability

header control

patch

nvd

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

5.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js.
A user can reuse an expired session by controlling the x-workos-session header. The vulnerability is patched in v0.4.2.

Affected configurations

Vulners

Node

workosauthkit_nextjsRange<0.4.2

CNA Affected

[
  {
    "vendor": "workos",
    "product": "authkit-nextjs",
    "versions": [
      {
        "version": "< 0.4.2",
        "status": "affected"
      }
    ]
  }
]