GHSA-35w3-6qhc-474v

@workos-inc/authkit-nextjs session replay vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-29901

Packages

Ecosystem	Package	Affected	Fixed in
npm	@workos-inc/authkit-nextjs	< 0.4.2	0.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A user can reuse an expired session by controlling the `x-workos-session` header. ### Patches Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2

References

External links from the advisory. They lead to third-party sites.

https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v web
https://nvd.nist.gov/vuln/detail/CVE-2024-29901 advisory
https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01 web
https://github.com/workos/authkit-nextjs package
https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2 web