CVE-2024-31995— zcap has incomplete expiration checks in capability chains.
Quick assessment
Affected
digitalbazaar zcap
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
zcap是Digital Bazaar开源的一个链接数据功能参考实施库。 zcap v9.0.1之前版本存在安全漏洞，该漏洞源于 Incomplete expiration 中的过期检查存在安全问题，允许在预期时间段之外进行调用。
Possible ATT&CK Techniques 1 AI
T1556 · Modify Authentication Process
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-31995
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
zcap has incomplete expiration checks in capability chains.
Source: CVE Program / CVE List V5
Vulnerability Description
`@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the `expires` property is not properly checked against the current date or other `date` param. This can allow invocations outside of the original intended time period. A zcap still cannot be invoked without being able to use the associated private key material. `@digitalbazaar/zcap` v9.0.1 fixes expiration checking. As a workaround, one may revoke a zcap at any time.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Vulnerability Title
zcap 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
zcap是Digital Bazaar开源的一个链接数据功能参考实施库。 zcap v9.0.1之前版本存在安全漏洞，该漏洞源于 Incomplete expiration 中的过期检查存在安全问题，允许在预期时间段之外进行调用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| digitalbazaar | zcap | < 9.0.1 | - |
|
II. Public POCs for CVE-2024-31995
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-31995
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-31995 (3)
-
https://github.com/digitalbazaar/zcap/pull/82 x_refsource_MISC
Vendor Advisories for CVE-2024-31995 (1)
-
https://github.com/digitalbazaar/zcap/security/advisories/GHSA-hp8h-7x69-4wmv x_refsource_CONFIRM
IV. Related Vulnerabilities
Same vendor: digitalbazaar
-
CVE-2026-85393
node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery v -
CVE-2026-33896
Forge has a basicConstraints bypass in its certificate chain -
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L -
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra f -
CVE-2026-33891
Forge has Denial of Service via Infinite Loop in BigInteger.
Same weakness: CWE-613
-
CVE-2024-8122
Potential brute force vulnerability due to non-expiring SMS -
CVE-2026-105690
Penpot: Server-side session not invalidated on logout; stale -
CVE-2026-97212
Monta monta.app Insufficient Session Expiration -
CVE-2026-104468
YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via -
CVE-2026-66253
HCL iControl is affected by a Session Timeout vulnerability
V. Comments for CVE-2024-31995
No comments yet