Auth bypass in Vercel Next.js
CVE-2024-46982
Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app rout…
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.581 (99.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Vercel Next.js — versions >= 13.5.1, < 13.5.7, >= 14.0.0, < 14.2.10
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9 (x_refsource_CONFIRM)
- https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3 (x_refsource_MISC)
- https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-46982?
- CVE-2024-46982 is a high-severity vulnerability in Vercel Next.js, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.5/10. Published 2024-09-17.
- How severe is CVE-2024-46982?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-46982 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.