Executive brief
@cyyynthia/tokenize is a universal token authentication library used to secure API and session access across applications. A bug in versions 1.1.0 through 1.1.2 causes generated tokens to have invalid expiration metadata, allowing them to remain valid indefinitely even after they should have been revoked. An attacker who obtains a faulty token can reuse it for unauthorized access long after a session should have ended.
Technical details
The vulnerability is an insufficient session expiration issue (CWE-613) in the token generation logic. A bug introduced in version 1.1.0 causes tokens to be generated with NaN (not-a-number) as the generation timestamp, breaking the expiration validation mechanism. As a result, the lastTokenReset field is not properly enforced, and tokens remain valid regardless of session timeout policies. An attacker who captures a token can continue using it for authentication without time constraints. The fix is available in version 1.1.3, which invalidates faulty tokens and restores proper expiration behavior in newly generated tokens. No workarounds exist for tokens already issued with the bug, as they lack the necessary metadata for retroactive invalidation.
Affected products
- cyyynthia @cyyynthia/tokenize 1.1.0 through 1.1.2
Timeline
- 2021-11-08: disclosed: GHSA-jcjx-c3j3-44pr published
- 2021-11-10: patched: Version 1.1.3 released with fix