Description
When invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the expires property is not properly checked against the current date or other date param. This can allow invocations outside of the original intended time period.
Recommendation
Update the @digitalbazaar/zcap package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.0.1
- Patched version(s): 9.0.1
References
Could your website be exposed too?
SmartScanner can check your website for zcap has incomplete expiration checks in capability chains. and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Plate media plugins has a XSS in media embed element when using custom URL parsers - CVE-2024-40631
- Slim Select has potential Cross-site Scripting issue - CVE-2024-9440
- LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - CVE-2026-42349
You might also like:
See something that needs correcting? Let us knowUpdated April 21, 2024