Session Fixation

2024-04-0103:29:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

session fixation

expired sessions

header control

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.1%

JSON

@workos-inc/authkit-nextjs vulnerable to Session Fixation. This vulnerability is due to the improper handling of expired sessions within session.ts. This allowing an attacker to reuse an expired session by controlling the x-workos-session header.

CPENameOperatorVersion
@workos-inc/authkit-nextjsle0.4.1
@workos-inc/authkit-nextjsle0.4.1

CPE	Name	Operator	Version
	@workos-inc/authkit-nextjs	le	0.4.1
	@workos-inc/authkit-nextjs	le	0.4.1

References

github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01

github.com/workos/authkit-nextjs/releases/tag/v0.4.2

github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v