Executive brief
The AuthKit library for Next.js, which provides authentication and session management for web applications, contains a vulnerability that allows users to reuse expired sessions. By manipulating specific web headers, an attacker could potentially maintain unauthorized access to an application even after their session should have ended. This could lead to unauthorized account access and data exposure.
Technical details
A session replay vulnerability (CWE-294) exists in the @workos-inc/authkit-nextjs library due to improper handling of the 'x-workos-session' header. An attacker can bypass session expiration by manually controlling this header, allowing for the reuse of stale or expired sessions. The root cause was identified in the session middleware where the header was not consistently cleared or validated during session updates. Exploitation requires the attacker to have network access and the ability to modify request headers, but no prior authentication is required to attempt the replay. The issue is resolved in version 0.4.2 by ensuring the header is properly managed during the request lifecycle.
Affected products
- WorkOS @workos-inc/authkit-nextjs < 0.4.2
Timeline
- 2024-03-28: patched: Version 0.4.2 released
- 2024-03-29: disclosed: GitHub Advisory published