Next runWithAmplifyServerContext operation sometimes returns contextSpec for another user if requests are in parallel

[MarekBodingerBA]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

React, Next.js

Amplify APIs

Authentication

Amplify Version

v6

Amplify Categories

auth

Backend

Other

Environment information

Details in the security advisory.

Describe the bug

I've reported a security advisory, as I can see the issues here are being assigned and resolved while the advisory is without a response for 21 hours. The issue seems to be critical and a bug in Amplify library. Please take a look at the advisory.

https://github.com/aws-amplify/amplify-js/security/advisories/GHSA-78h9-vrf3-cxx5

Expected behavior

Details in the security advisory.

Reproduction steps

Details in the security advisory.

Code Snippet

Details in the security advisory.

Log output

// Put your logs below this line

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

No response

[haverchuck]

@MarekBodingerBA We are investigating.