Executive brief
Keystone-6/core, a headless CMS platform, uses a deprecated and cryptographically insecure identifier library (cuid) by default for generating database record IDs. The cuid package leaks timing information, which could theoretically enable attackers to predict or enumerate object identifiers in applications built with Keystone-6. While not a direct code vulnerability, using this weak identifier scheme undermines security in typical database applications and should be replaced with a modern secure alternative.
Technical details
The vulnerability stems from Keystone-6/core's use of the deprecated cuid package for generating database identifiers by default. Cuid is a k-sortable, monotonically increasing ID scheme that embeds timestamp information, making it non-cryptographic and unsuitable for security-sensitive applications. The attack vector requires no network access or special privileges—any user of Keystone-6 with the default configuration inherits this weak identifier behavior. An attacker can analyze the timestamp and sequence components of cuid identifiers to predict future IDs or enumerate existing records. The maintainers recommend migrating to @paralleldrive/cuid2, which generates random 24-character base36 strings, or implementing application-specific secure ID strategies. No patch version has been released; workarounds exist for custom identifier implementations, but the default configuration remains affected.
Affected products
- Keystone @keystone-6/core All versions up to and including 5.3.1
Timeline
- 2023-06-12: disclosed: GHSA-5fp6-4xw3-xqq3 published; advisory accepted by maintainer