CVE-2022-24740: Sudden swap of user auth tokens in Volto
Summary
CVE-2022-24740: Sudden swap of user auth tokens in Volto. Affects @plone/volto versions >= 14.0.0-alpha.6, < 15.0.0-alpha.0. Fixed in 15.0.0-alpha.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Volto is an open-source content management system (CMS) built on top of Plone. It provides a modern and user-friendly interface for managing content and building websites. The vulnerability affects versions of Volto prior to 15.0.0-alpha.0. Volto uses the react-cookie library for handling authentication tokens.
Vulnerability Detail
The vulnerability arises from the usage of an outdated version of the react-cookie library in Volto. Under high server load, there is a possibility that a user's authentication cookie could be replaced with the authentication cookie of another user. This would grant the user unauthorized access to the other user's account and privileges. While there is no proven exploit for this vulnerability, it can occur randomly and unintentionally in real-world scenarios.
How To Fix
Latest published version: 19.5.1 as of 22 Oct 2026
npm install @plone/volto@19.5.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
15.0.0-alpha.0
This is the first release that contains the fix.
npm install @plone/volto@15.0.0-alpha.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to Volto 15.0.0-alpha.0 is not immediately feasible, a temporary workaround is to manually upgrade the react-cookie package to version 4.1.1. Additionally, all Volto components that use this library should be overridden. This workaround involves substantial work and is not recommended as a long-term solution.
Conclusion
The vulnerability in Volto allows for the potential swapping of user authentication tokens, granting unauthorized access to user accounts. It is crucial to upgrade to Volto 15.0.0-alpha.0 or later to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @plone/volto →
FAQ
Volto is an open-source content management system (CMS) built on top of Plone. It provides a modern and user-friendly interface for managing content and building websites.
The vulnerability allows a user to potentially gain unauthorized access to another user's account and privileges in Volto.
No, there is no proven exploit for this vulnerability. It can occur randomly and unintentionally in real-world scenarios.
The recommended fix is to upgrade to Volto 15.0.0-alpha.0 or later. Detailed upgrade instructions can be found in the Volto upgrade guide.
A temporary workaround is to manually upgrade the react-cookie package to version 4.1.1 and override all Volto components that use this library. However, this is not recommended as a long-term solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for @plone/volto.
