@valtimo/components exposes access token to form.io
Impact
When opening a form in Valtimo, the access token (JWT) of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user.
This issue is caused by a misconfiguration of the Form.io component.
Attack requirements
The following conditions have to be met in order to perform this attack:
- An attacker needs to have access to the network traffic on the
api.form.iodomain. - The content of the
x-jwt-tokenheader is logged or otherwise available to the attacker. - An attacker needs to have network access to the Valtimo API.
- An attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes.
Patches
Versions 10.8.4, 11.1.6 and 11.2.2 have been patched
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @valtimo/components | < 10.8.4, >= 11.0.0, < 11.1.6, >= 11.2.0, < 11.2.2 | 10.8.4, 11.1.6, 11.2.2 |
References
- https://github.com/valtimo-platform/valtimo-frontend-libraries/security/advisories/GHSA-xcp4-62vj-cq3r
- https://nvd.nist.gov/vuln/detail/CVE-2024-34706
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/1aaba5ef5750dafebbc7476fb08bf2375a25f19e
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/8c2dbf2a41180d2b0358d878290e4d37168f0fb6
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/d65e05fd2784bd4a628778b34a5b79ce2f0cef8c
- https://github.com/valtimo-platform/valtimo-frontend-libraries
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-532- Platform
- npm
- Package
@valtimo/components- Disclosed
- 13.05.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-xcp4-62vj-cq3r - CC BY 4.0
Vulnerability history: @valtimo/components
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.