AIKIDO-2026-808118

TL;DR

The session() and getSession(req) server helpers decode the client-supplied x-descope-session request header from Base64 and return it as trusted authentication data without validating the JWT signature. When this header is present it is returned before the cookie path that would call validateJwt, so signature verification is never reached. An unauthenticated request can forge arbitrary session claims, including user identity and roles such as admin, to bypass authentication in any route handler or server component that relies on these helpers. The fix removes the unvalidated header path so session data is only accepted after JWT validation.