@valtimo/components exposes access token to form.io
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component. The following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the `api.form.io` domain; the content of the `x-jwt-token` header is logged or otherwise available to the attacker; an attacker needs to have network access to the Valtimo API; and an attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes. Versions 10.8.4, 11.1.6 and 11.2.2 have been patched.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| valtimo-platform | valtimo-frontend-libraries | before 10.8.4; 11.0.0 to before 11.1.6; 11.2.0 to before 11.2.2 | 10.8.4, 11.1.6, 11.2.2 | Patch available | CNA |
| — | @valtimo/components (npm) | before 10.8.4 | 10.8.4 | Patch available | GHSA-xcp4-62vj-cq3r |
| — | @valtimo/components (npm) | 11.0.0 to before 11.1.6 | 11.1.6 | Patch available | GHSA-xcp4-62vj-cq3r |
| — | @valtimo/components (npm) | 11.2.0 to before 11.2.2 | 11.2.2 | Patch available | GHSA-xcp4-62vj-cq3r |
- valtimo-frontend-libraries Vendorvaltimo-platform Affected before 10.8.4; 11.0.0 to before 11.1.6; 11.2.0 to before 11.2.2 Fixed in 10.8.4, 11.1.6, 11.2.2 Patch available CNA
- @valtimo/components (npm) Vendor— Affected before 10.8.4 Fixed in 10.8.4 Patch available GHSA-xcp4-62vj-cq3r
- @valtimo/components (npm) Vendor— Affected 11.0.0 to before 11.1.6 Fixed in 11.1.6 Patch available GHSA-xcp4-62vj-cq3r
- @valtimo/components (npm) Vendor— Affected 11.2.0 to before 11.2.2 Fixed in 11.2.2 Patch available GHSA-xcp4-62vj-cq3r
CPE names CISA-ADP · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:valtimo:frontend-libraries:*:*:*:*:*:*:*:* | — | — | — |
| cpe:2.3:a:valtimo:frontend-libraries:11.2.0:*:*:*:*:*:*:* | 11.2.0 | — | — |
| cpe:2.3:a:valtimo:frontend-libraries:11.0.0:*:*:*:*:*:*:* | 11.0.0 | — | — |
- cpe:2.3:a:valtimo:frontend-libraries:*:*:*:*:*:*:*:* Versions — — ·—
- cpe:2.3:a:valtimo:frontend-libraries:11.2.0:*:*:*:*:*:*:* Versions 11.2.0 — ·—
- cpe:2.3:a:valtimo:frontend-libraries:11.0.0:*:*:*:*:*:*:* Versions 11.0.0 — ·—
Remediation
- Fix · CNA valtimo-frontend-libraries (valtimo-platform) Fixed in 10.8.4, 11.1.6, 11.2.2
- Fix · GHSA-xcp4-62vj-cq3r @valtimo/components (npm) Fixed in 10.8.4 Advisory →
- Fix · GHSA-xcp4-62vj-cq3r @valtimo/components (npm) Fixed in 11.1.6 Advisory →
- Fix · GHSA-xcp4-62vj-cq3r @valtimo/components (npm) Fixed in 11.2.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34706
- 2026-10-03 Alias added: GHSA-xcp4-62vj-cq3r
References
Other 5
- https://github.com/valtimo-platform/valtimo-frontend-libraries/security/advisories/GHSA-xcp4-62vj-cq3r
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/1aaba5ef5750dafebbc7476fb08bf2375a25f19e
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/8c2dbf2a41180d2b0358d878290e4d37168f0fb6
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/d65e05fd2784bd4a628778b34a5b79ce2f0cef8c
- https://github.com/valtimo-platform/valtimo-frontend-libraries
More valtimo-platform vulnerabilities
- TI-2026-30835 Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users CVSS 3.1CRITICAL 9.1
- TI-2025-35902 Valtimo scripting engine can be used to gain access to sensitive data or resources CVSS 3.1CRITICAL 9.1
- TI-2025-31031 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users CVSS 3.1HIGH 8.3
- TI-2026-32446 Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer CVSS 3.1HIGH 7.6
- TI-2026-26464 Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService CVSS 3.1MEDIUM 4.9
Sources
- CVE-2024-34706 · CVE Program
- CVE-2024-34706 · NVD
- FIRST EPSS
- GHSA-xcp4-62vj-cq3r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences