CVE-2024-29901
CVE-2024-29901 · @workos-inc/authkit-nextjs session replay vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
CVSS 4.8 · Medium · EPSS 0.7% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
authkit-nextjs
- Versions
- < 0.4.2: Affected
No fix published
@workos-inc/authkit-nextjs npm
- Affected ranges
- SEMVER: < 0.4.2
Update to 0.4.2