AIKIDO-2024-10389
@kinde-oss/kinde-auth-nextjs is vulnerable to Improper Certificate Validation
65
Medium Risk
This Affects:
@kinde-oss/kinde-auth-nextjsTL;DR
Affected versions of this package fail to properly validate security certificates. If the security tokens exist in the cookie storage, the isAuthenticatedFactory() function incorrectly returns true without verifying the expiration or issuer of the token. This flaw allows unauthorized access, as it bypasses essential security checks that should validate the integrity and validity of the token.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@kinde-oss/kinde-auth-nextjs is vulnerable to Improper Certificate Validation in versions 1.8.1 - 2.3.11.
How to fix this
Upgrade the @kinde-oss/kinde-auth-nextjs library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant