AIKIDO-2025-10459

TL;DR

Affected versions of this package are vulnerable to Token Expiration Bypass due to a logic flaw in expiresAt verification. The token validation logic incorrectly bypasses expiration checks when authInfo.expiresAt is set to 0, as the condition !authInfo.expiresAt evaluates to false, skipping the expiration validation entirely. This flaw allows tokens with an expiration time of 0, which should be interpreted as expired or invalid, to be accepted as valid. An attacker could exploit this by crafting or reusing a token with expiresAt: 0 to bypass intended expiration controls, gaining unauthorized persistent access to protected resources.