CVE-2024-29901 @workos-inc/authkit-nextjs session replay vulnerability
Attackers can reuse expired sessions by manipulating headers, allowing unauthorized access to user accounts in Next.js applications using AuthKit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29901?
CVE-2024-29901 is a medium-severity authentication bypass vulnerability in workos authkit-nextjs, published on 29 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
Weakness: CWE-294
Which versions are affected by CVE-2024-29901?
2 open source packages ship an affected version, including @workos-inc/authkit-nextjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@workos-inc/authkit-nextjs npm | All versions | 0.4.2 |
@workos-inc/authkit-nextjs npm | All versions | 0.4.2 |
Products include Workos Authkit-Nextjs.
How do I fix CVE-2024-29901?
Upgrade @workos-inc/authkit-nextjs to 0.4.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-29901 being exploited?
There is no known exploitation of CVE-2024-29901 in the wild and no public exploit code.
Other vulnerabilities in workos authkit-nextjs
Sources
Also known as GHSA-35w3-6qhc-474v.