2024 WorkOS — CVE-2024-29901 session replay
Data compromised
Potential: unauthorized session reuse
Technical writeup
authkit-nextjs session replay: x-workos-session header allowed reuse of expired sessions. Versions before 0.4.2. Moderate severity. Patched 0.4.2.
Root cause
Session validation bypass