CVE-2024-29901

Published: Mar 29, 2024Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.

Affected (1)

Products: Workos: Authkit Nextjs

Workos

1 product

Authkit Nextjs

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Workos Authkit Nextjs	Before 0.4.2

Related CWEs

CWE-294

Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References (6)

https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01

Source: security-advisories@github.com

Patch

https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2

Source: security-advisories@github.com

Release Notes

https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v

Source: security-advisories@github.com

Vendor Advisory

https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.