CVE-2024-31995

CVE-2024-31995 affects the @digitalbazaar/zcap JavaScript library, specifically versions prior to 9.0.1. The vulnerability allows for the invocation of delegated capabilities (with a chain depth of 2) even after their intended expiration date, due to an improper check of the 'expires' property. This is a medium-severity vulnerability (CVSS 4.3) with a low attack complexity, requiring authenticated access (PR:L) and potentially leading to a loss of confidentiality (C:L). While it allows for unauthorized invocation outside the intended timeframe, it does not bypass the requirement for the associated private key material. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. The vendor has released a fix in version 9.0.1, and revocation of zcaps can serve as a workaround.