# CVE-2024-29901: WorkOS AuthKit Next.js session replay vulnerability

Source: https://junglewise.ai/threats/cve-2024-29901-workos-authkit-next-js-session-replay-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-03-29. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2024-29901 · Severity: low · CVSS 3.1 · Published 2024-03-29

The AuthKit library for Next.js, which provides authentication and session management for web applications, contains a vulnerability that allows users to reuse expired sessions. By manipulating specific web headers, an attacker could potentially maintain unauthorized access to an application even after their session should have ended. This could lead to unauthorized account access and data exposure.

Technologies: [@workos-inc/authkit-nextjs (npm)](https://junglewise.ai/threats/technologies/workos-inc-authkit-nextjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [WorkOS](https://junglewise.ai/threats/vendors/workos).

## Quick answers

**Is CVE-2024-29901 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-29901 being exploited in the wild.

**How severe is CVE-2024-29901?** Low severity, with a CVSS score of 3.1, published 29 March 2024.

**Which products and versions are affected?** @workos-inc/authkit-nextjs (npm) SEMVER:introduced=0,fixed=0.4.2.

**Is there a fix for CVE-2024-29901?** Yes. @workos-inc/authkit-nextjs (npm): upgrade to 0.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-29901 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-29901?** Check whether you run @workos-inc/authkit-nextjs (npm) or WorkOS AuthKit Next.js SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @workos-inc/authkit-nextjs (npm): upgrade to 0.4.2 or later

  ```sh
  npm install @workos-inc/authkit-nextjs@0.4.2
  ```


## Technical details

A session replay vulnerability (CWE-294) exists in the @workos-inc/authkit-nextjs library due to improper handling of the 'x-workos-session' header. An attacker can bypass session expiration by manually controlling this header, allowing for the reuse of stale or expired sessions. The root cause was identified in the session middleware where the header was not consistently cleared or validated during session updates. Exploitation requires the attacker to have network access and the ability to modify request headers, but no prior authentication is required to attempt the replay. The issue is resolved in version 0.4.2 by ensuring the header is properly managed during the request lifecycle.

## Affected products

- WorkOS @workos-inc/authkit-nextjs < 0.4.2

## Identifiers

- CVE-2024-29901
- GHSA-35w3-6qhc-474v

## Timeline

- 2024-03-28: patched: Version 0.4.2 released
- 2024-03-29: disclosed: GitHub Advisory published

## References

- [https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v](https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v)
- [https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01](https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01)
- [https://github.com/workos/authkit-nextjs](https://github.com/workos/authkit-nextjs)
- [https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2](https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2)

## Related threats

- [WorkOS authkit-nextjs session cookie caching in CDNs](https://junglewise.ai/threats/cve-2025-64762-workos-authkit-nextjs-session-cookie-caching-in-cdns)
- [WorkOS AuthKit Next.js sensitive token logging in debug mode](https://junglewise.ai/threats/cve-2024-51752-workos-authkit-next-js-sensitive-token-logging-in-debug-mode)