# CVE-2022-24740: Plone Volto auth token swap due to outdated react-cookie

Source: https://junglewise.ai/threats/cve-2022-24740-plone-volto-auth-token-swap-due-to-outdated-react-cookie  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-24740 · Severity: low · CVSS 3.1 · Published 2022-03-14

Volto is a React frontend for the Plone content management system. Due to an outdated react-cookie library dependency, users under high server load conditions can have their authentication tokens replaced with another user's token, granting complete unauthorized access to that user's account and permissions.

Technologies: [Plone Volto](https://junglewise.ai/threats/technologies/volto). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Plone](https://junglewise.ai/threats/vendors/plone).

## Quick answers

**Is CVE-2022-24740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-24740 being exploited in the wild.

**How severe is CVE-2022-24740?** Low severity, with a CVSS score of 3.1, published 14 March 2022.

**Which products and versions are affected?** @plone/volto (npm) SEMVER:introduced=14.0.0-alpha.6,fixed=15.0.0-alpha.0; Plone Volto 14.0.0-alpha.6 through 14.10.0.

**Is there a fix for CVE-2022-24740?** Yes. @plone/volto (npm): upgrade to 15.0.0-alpha.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-24740 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-24740?** Check whether you run @plone/volto (npm) or Plone Volto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @plone/volto (npm): upgrade to 15.0.0-alpha.0 or later

  ```sh
  npm install @plone/volto@15.0.0-alpha.0
  ```


## Technical details

The vulnerability stems from the use of an outdated version of the react-cookie library in Volto versions 14.0.0-alpha.6 through 14.10.0. Under conditions of high server load, a race condition or token handling bug in the react-cookie library can cause one user's authentication cookie to be replaced with another user's cookie. Attack vector is network-based and requires user interaction (browsing the application); no special privileges are required. While no proven public exploit exists and reproduction has been difficult, the vulnerability can occur randomly in production environments. The fix is available in Volto 15.0.0-alpha.0 and later, which upgrades react-cookie to version 4.1.1 and includes related component changes.

## Affected products

- Plone Volto 14.0.0-alpha.6 through 14.10.0

## Identifiers

- CVE-2022-24740
- GHSA-cfhh-xgwq-5r67

## Timeline

- 2022-03-14: disclosed
- 2022-03-14: patched: Fix available in Volto 15.0.0-alpha.0 and later

## References

- [https://github.com/plone/volto/security/advisories/GHSA-cfhh-xgwq-5r67](https://github.com/plone/volto/security/advisories/GHSA-cfhh-xgwq-5r67)

## Related threats

- [Plone Volto denial of service via specific URL](https://junglewise.ai/threats/cve-2025-61668-plone-volto-denial-of-service-via-specific-url)
- [Plone Volto denial-of-service by specific URL](https://junglewise.ai/threats/cve-2025-58047-plone-volto-denial-of-service-by-specific-url)