CybersecurityHacking

Vercel Bolsters Defenses Against Stolen Session Cookie Attacks

Analyst 207||Source: BleepingComputer
Laptop with fingerprint sensor on palm rest sits on clean surface with blurred background.

"DBSC works by storing a private key in your device's TPM (the same device that the fingerprint sensor or similar biometric devices on your laptop or phone uses) and using that key to sign your cookie," explained Malte Ubl.

Device Bound Session Credentials (DBSC)

Vercel has begun a gradual rollout of Device Bound Session Credentials (DBSC) on its platform to reduce the risk posed by information-stealer malware. The feature binds a login session on vercel.com to a user's device by storing a private key in the device's TPM and using that key to sign the session cookie. According to the company, "The private key can never be retrieved ever again. Not by us, not by you, not by the malware."

The announcement was made by Vercel's CTO, Malte Ubl, on X, and targets logins to Vercel's developer-facing console where projects and deployments are managed. Vercel positions DBSC as a layer of protection that prevents stolen session cookies from being reused on other devices.

Chrome's App‑Bound Encryption and the DBSC pairing

Vercel said DBSC complements Chrome's App‑Bound Encryption. While App‑Bound Encryption aims to make it harder for infostealer malware to extract browser cookies, DBSC takes the next step by ensuring that even if a cookie is stolen, it cannot be replayed from a different device. Vercel's rollout notes that DBSC currently works in Chrome on macOS and Windows and that the company is rolling the feature out gradually to ensure edge cases involving OAuth apps are handled appropriately.

DPoP for the Vercel CLI

Alongside DBSC for browser sessions, Vercel is also rolling out a similar protective technology called DPoP for the Vercel CLI. The company framed these changes as platform-level mitigations aimed at reducing the value of stolen credentials across different access vectors used by developers.

Security Review public beta for Pro and Enterprise teams

Earlier the same week, Vercel launched Security Review in public beta for Pro and Enterprise teams. The feature is an addition to Vercel Agent that, once enabled, scans code changes on every push to connected GitHub repositories. Vercel says the system uses code and team-defined policies to flag issues such as missing authorization checks and exposed secrets.

If the Vercel Agent has the necessary permissions, it can validate and commit fixes; Vercel noted that agent-generated fixes will be billed separately. Security Review scans will be free until November 10, 2026, the company said. Ubl added that Vercel's security team had shipped the feature internally a couple of months prior and decided to make it broadly available after internal success.

Context: the April breach and the threat actor response

Vercel's recent security product pushes come after an April security breach that the company said affected a subset of customers. In that incident, attackers gained access to Vercel systems by compromising an employee's Google Workspace account at Context.ai. Vercel reported the attacker used those credentials to reach internal systems and view environment variables that had not been marked as sensitive.

Following the breach, a threat actor impersonating ShinyHunters attempted to sell the allegedly stolen source code, access keys, and database data. Those events are part of the backdrop Vercel cited in explaining why additional controls like DBSC, DPoP, and Security Review are being deployed.

What this means for developers, security teams, and adversaries

  • Developers: Developers who manage projects on vercel.com gain a session model that refuses cookie replay across devices when DBSC is active; however, the protection is currently limited to Chrome on macOS and Windows while the rollout addresses OAuth edge cases.
  • Security teams and Pro/Enterprise buyers: Security Review offers an automated, policy-driven scan of GitHub pushes with agent-assisted fixes available if permissions allow, and Vercel has set scans to be free through November 10, 2026 while charging separately for agent-applied fixes.
  • Adversaries and opportunistic sellers: Vercel's measures — DBSC, DPoP, and automated code/secret scanning — are designed to decrease the resale value of stolen cookies, keys, and source material, a response plainly linked to the April compromise and subsequent attempted sales.

Next questions for Vercel's rollout

Vercel has taken concrete steps to harden developer access and to surface code-level risks, but the company itself notes the rollout is gradual. The immediate questions left on the record are practical: how quickly DBSC will expand beyond Chrome on macOS and Windows, how OAuth edge cases will be resolved in real-world teams, and how broadly customers will adopt agent permissions that allow Vercel to validate and commit fixes.

The company has tied these product moves to an operational imperative that followed the April breach. For teams that host, deploy, or build on Vercel — and for buyers evaluating Pro and Enterprise plans — the coming weeks will show whether these controls materially reduce credential reuse and secret exposure in the platform's ecosystem.

Source: BleepingComputer — Vercel rolls out new protection against stolen session cookie attacks

Emerging ThreatsWeb Application SecurityDevice Bound Session CredentialsMFASession Cookie SecurityTPMInformation-Stealer Malware
Related Intelligence

Continue Reading

A modern device with a blurred screen sits on a plain surface against a subtle gradient background.

Apple Scans iCloud Shares for Harmful Content

Get ready for a safer iCloud experience: Apple is taking a proactive approach to protecting its users by scanning publicly shared iCloud links for harmful content in its upcoming software update, iOS 27.3. This new security measure only applies to links shared with Anyone with the Link, helping to keep you and your community safe online.

Analyst 207
Network operations room with rows of computer servers and equipment on racks.

SonicWall Leaves Unpatched EoL GMS Flaws Exposed

SonicWall has warned that its Global Management System (GMS) has reached end-of-life, leaving two major vulnerabilities unpatched - and is urging users to upgrade to the SonicWall Network Security Manager (NSM) as a matter of urgency. The unpatched flaws, including a critical unauthenticated file read vulnerability with a CVSS score of 9.1, pose a significant security risk to organizations still using the outdated GMS.

Analyst 207
Rows of rack-mounted computer equipment and cables in a server room.

Xen Hypervisor Flaws Expose Guest VMs to Unauthorized Memory Access

A single compromised guest can break free from its isolation and take control of the entire host, thanks to two critical flaws in the Xen Hypervisor that allow unauthorized memory access. This vulnerability, tracked as XSA-523, lets malicious guest virtual machines read and write the memory of other VMs on the same host.

Analyst 207
Server room with rows of equipment and a blurred laptop screen in the foreground.

Rails Flaw Exposes Servers to File Write Attacks via ImageMagick Uploads

A critical Rails security flaw, rated 9.8 out of 10, allows unauthenticated attackers to write arbitrary files to a server - and even read sensitive files - through vulnerable ImageMagick uploads. This devastating vulnerability affects Active Storage users who rely on ImageMagick for image processing and store uploads on their server's disk.

Analyst 207