Description
Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that a user could get his/her auth cookie replaced with the auth cookie from another user, effectively giving him full access to the other users account and privileges.
Recommendation
Update the @plone/volto package to the latest compatible version. Followings are version details:
- Affected version(s): >= 14.0.0-alpha.6, <= 14.10.0
- Patched version(s): 15.0.0-alpha.0
References
Could your website be exposed too?
SmartScanner can check your website for Sudden swap of user auth tokens in Volto and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user - CVE-2025-61668
- Volto affected by possible DoS by invoking specific URL by anonymous user - CVE-2025-58047
- Strapi may leak sensitive user information, user reset password, tokens via content-manager views - @strapi/utils - CVE-2023-36472
- auth-js Vulnerable to Insecure Path Routing from Malformed User Input - CVE-2025-48370
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023