---
title: "CVE-2024-34706: @valtimo/components exposes access token to form.io"
url: https://erroneo.us/security/cve/CVE-2024-34706/
description: "CVE-2024-34706 (@valtimo/components (npm)): Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the…"
type: vulnerability-record
section: "Security Digest"
date_published: 2024-05-13
date_modified: 2024-08-02
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2024-34706"
kev: false
cvss: 9.8
epss: 0.01057
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2024-34706: @valtimo/components exposes access token to form.io

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 1.1% , percentile 64: FIRST’s model estimates a 1.1% chance of exploitation activity in the next 30 days, higher than 64% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes @valtimo/components (npm) < 10.8.4, fixed in 10.8.4 ; @valtimo/components (npm) >= 11.0.0, < 11.1.6, fixed in 11.1.6 ; @valtimo/components (npm) >= 11.2.0, < 11.2.2, fixed in 11.2.2 . Check your lockfile, including transitive dependencies.

## What it is

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component. The following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the api.form.io domain; the content of the x-jwt-token header is logged or otherwise available to the attacker; an attacker needs to have network access to the Valtimo API; and an attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes. Versions 10.8.4, 11.1.6 and 11.2.2 have been patched.

## Affected packages

- npm `@valtimo/components` < 10.8.4 → fixed: 10.8.4
- npm `@valtimo/components` >= 11.0.0, < 11.1.6 → fixed: 11.1.6
- npm `@valtimo/components` >= 11.2.0, < 11.2.2 → fixed: 11.2.2

## Affected products (CVE record)

- valtimo-platform valtimo-frontend-libraries: < 10.8.4, >= 11.0.0, < 11.1.6, >= 11.2.0, < 11.2.2

## Severity

- GitHub_M CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 1.06% probability of exploitation activity in the next 30 days; percentile 64.

## Sources

- [GitHub Advisory GHSA-xcp4-62vj-cq3r](https://github.com/advisories/GHSA-xcp4-62vj-cq3r)
- [CVE.org record CVE-2024-34706](https://www.cve.org/CVERecord?id=CVE-2024-34706)
- [NVD entry CVE-2024-34706](https://nvd.nist.gov/vuln/detail/CVE-2024-34706)
- [github.com](https://github.com/valtimo-platform/valtimo-frontend-libraries/security/advisories/GHSA-xcp4-62vj-cq3r)
- [github.com](https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/1aaba5ef5750dafebbc7476fb08bf2375a25f19e)
- [github.com](https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/8c2dbf2a41180d2b0358d878290e4d37168f0fb6)
- [github.com](https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/d65e05fd2784bd4a628778b34a5b79ce2f0cef8c)

---
Source page: https://erroneo.us/security/cve/CVE-2024-34706/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt