Vercel Deploys Device Bound Session Credentials to Blunt Session-Hijacking via Infostealers, Adds AI Security Review
Vercel has rolled out Device Bound Session Credentials (DBSC) and launched Vercel Security Review in public beta to reduce the impact of session hijacking and insecure code. DBSC cryptographically binds login sessions to the device that created them, mitigating "pass-the-cookie" attacks enabled by infostealers such as Lumma, RedLine, and Vidar, which steal post-authentication session cookies that bypass passwords and MFA. The technology relies on a hardware-backed public/private key pair (TPM or Secure Enclave) and short-lived cookies that must be continuously refreshed via proof of key possession, rendering stolen cookies useless once they expire. Separately, Vercel Security Review, part of Vercel Agent, is an AI-driven code scanner that reviews code changes pushed to GitHub for vulnerabilities, surfacing findings as pull-request comments and in a security dashboard.
Detalhes técnicos
DBSC is currently supported only by Chrome on Mac and Windows, with Vercel developing a less-secure polyfill for broader browser support. The rollout is gradual due to complexities such as OAuth app integrations. Vercel is also developing Demonstrating Proof-of-Possession (DPoP) for its CLI. Vercel Security Review scans only code changed since the last deployment, traces reachability of the changed code, and checks for existing mitigations before flagging issues; it can also auto-generate minimal fixes and tests.
Remediação
Organizations using Vercel should enable DBSC where supported (Chrome on Mac/Windows) to reduce exposure to cookie-theft-based account takeover from infostealer infections. Pro and Enterprise teams can enable Vercel Security Review, free until November 10, 2026, to catch vulnerabilities introduced via code pushes before deployment.
Linha do tempo
-
Vercel Deploys Device Bound Session Credentials to Blunt Session-Hijacking via Infostealers, Adds AI Security Review
ler a análise desta fonte ocultar
Vercel has rolled out Device Bound Session Credentials (DBSC) and launched Vercel Security Review in public beta to reduce the impact of session hijacking and insecure code. DBSC cryptographically binds login sessions to the device that created them, mitigating "pass-the-cookie" attacks enabled by infostealers such as Lumma, RedLine, and Vidar, which steal post-authentication session cookies that bypass passwords and MFA. The technology relies on a hardware-backed public/private key pair (TPM or Secure Enclave) and short-lived cookies that must be continuously refreshed via proof of key possession, rendering stolen cookies useless once they expire. Separately, Vercel Security Review, part of Vercel Agent, is an AI-driven code scanner that reviews code changes pushed to GitHub for vulnerabilities, surfacing findings as pull-request comments and in a security dashboard.
Technical Details
DBSC is currently supported only by Chrome on Mac and Windows, with Vercel developing a less-secure polyfill for broader browser support. The rollout is gradual due to complexities such as OAuth app integrations. Vercel is also developing Demonstrating Proof-of-Possession (DPoP) for its CLI. Vercel Security Review scans only code changed since the last deployment, traces reachability of the changed code, and checks for existing mitigations before flagging issues; it can also auto-generate minimal fixes and tests.
Remediation
Organizations using Vercel should enable DBSC where supported (Chrome on Mac/Windows) to reduce exposure to cookie-theft-based account takeover from infostealer infections. Pro and Enterprise teams can enable Vercel Security Review, free until November 10, 2026, to catch vulnerabilities introduced via code pushes before deployment.