Skip to content
Vercel Introduces Device Bound Session Credentials to Combat Session Hijacking

Vercel Introduces Device Bound Session Credentials to Combat Session Hijacking

First seen 5 Nov 2026, 15:16 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 5, 2026 at 15:17 UTC
  • •Vercel's DBSC ties sessions to devices, preventing cookie reuse.
  • •The rollout is gradual, currently limited to Chrome on macOS and Windows.
  • •Security Review scans code for vulnerabilities on GitHub pushes.

Vercel has launched Device Bound Session Credentials (DBSC) to enhance security against session hijacking attacks, particularly from info-stealer malware like Lumma and RedLine. DBSC ties a user's login session to their device using a private key stored in secure hardware, rendering stolen session cookies useless on other devices. The rollout is gradual, currently supporting Chrome on macOS and Windows, with plans for broader compatibility. Additionally, Vercel has introduced a public beta of its Security Review feature, which scans code for vulnerabilities during GitHub pushes. This feature is available for Pro and Enterprise teams and will be free until November 10, 2026. Vercel's CTO, Malte Ubl, emphasized the importance of this technology following a previous security breach in April 2026, which exposed internal systems due to compromised credentials.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-11-04
DBSC rollout begins
Vercel's CTO announced the gradual rollout of Device Bound Session Credentials to enhance security against session cookie theft.
Bleepingcomputer
2026-11-05
Vercel announces DBSC and Security Review
Vercel introduced Device Bound Session Credentials and launched Security Review in public beta for Pro and Enterprise teams.
Helpnetsecurity

More articles in this cluster (3)

Following this threat?

Track Lumma and Vercel in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 2

Common questions

What is Device Bound Session Credentials?
DBSC is a security feature that ties a user's session to their device, preventing stolen session cookies from being reused.
Which browsers support DBSC?
Currently, DBSC is supported only in Chrome on macOS and Windows.
How does the Security Review feature work?
It scans code for vulnerabilities during GitHub pushes and provides findings in pull requests.