@workos-inc/authkit-nextjs session replay vulnerability

높음 8.1CVE-2024-29901 · GHSA-35w3-6qhc-474v · Published 29/03/2024 · updated 17/06/2026

요약

CVE-2024-29901은(는) authkit-nextjs (workos), @workos-inc/authkit-nextjs에 영향을 주는 높음 (CVSS 8.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.66%, 전체 취약점의 51.5%보다 높음.
조치: 0.4.2 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
authkit-nextjs workos	`< 0.4.2`	`0.4.2`
@workos-inc/authkit-nextjs npm	`< 0.4.2`	`0.4.2`

Description

Impact

A user can reuse an expired session by controlling the x-workos-session header.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2

NVD description

The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.

References

workos/authkit-nextjs security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-29901 · ADVISORY
workos/authkit-nextjs commit 6c3f4f3 · WEB
workos/authkit-nextjs · PACKAGE
workos/authkit-nextjs release v0.4.2 · WEB

authkit-nextjs의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

authkit-nextjs

workos

< 0.4.2

0.4.2

@workos-inc/authkit-nextjs

npm

< 0.4.2

0.4.2

Description

Impact

A user can reuse an expired session by controlling the x-workos-session header.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2

NVD description

authkit-nextjs의 다른 취약점

모두 보기 →