AIKIDO-2025-10276

TL;DR

Affected versions of this package did not enforce an expiration for the JSON Web Encryption (JWE) token within the cookie, relying solely on the cookie's expiry setting, which means that the JWE token remains valid even after the cookie expiration. An attacker can take leverage of this misconfiguration by extracting the JWE token from an expired cookie and reusing it in malicious requests, bypassing session termination. Since the server only checked the cookie's expiration and not the embedded expiration of the JWE token, this flaw could lead to unauthorized access.