Vercel starts binding dashboard sessions to devices with DBSC in Chrome
Vercel is gradually rolling out Device Bound Session Credentials for vercel.com sign-ins, so a stolen session cookie stops working away from the device that holds the key. It works only in Chrome on Mac and Windows for now, and DPoP for the Vercel CLI is in progress.
Vercel has begun a gradual rollout of Device Bound Session Credentials (DBSC) for sign-ins to vercel.com, CTO Malte Ubl said this week, as reported by Help Net Security. Under DBSC, the browser creates a key pair at login and, per Chrome's documentation, keeps the private key in secure hardware such as a TPM where available. The server then issues short-lived cookies that the browser must keep refreshing by signing a challenge with that key, so a cookie copied to another machine soon stops working. Ubl said DBSC is "currently only supported by Chrome on Mac and Windows," that the rollout is slow because of "lots of special cases for things like [OAuth] apps," and that Vercel is building a polyfill for other browsers that is "less secure." Vercel is also working on DPoP for its command-line tool.
Why it matters
Vercel has a direct reason to care. Its April 2026 incident started when an attacker used a compromised third-party AI tool to take over an employee's Google Workspace account and then their Vercel account. Stolen session cookies, usually lifted by infostealers, are the common way past MFA, and device-bound session credentials are the browser control aimed at that session cookie theft.
Two limits apply. The W3C draft says DBSC does not stop an attacker who is resident on the user's device from using the live session, and it covers browser sessions only. Tokens used by the CLI and API stay bearer tokens until DPoP ships, so keep those scoped, short-lived and out of shared environment files. Developers who run their own apps on Vercel can add DBSC to their own login flow; Chrome falls back to normal cookies where secure key storage is missing.
Source: Help Net Security, Chrome for Developers
Related on Start with Identity
- BlogHuntress tracks stolen-session replay into 79 Microsoft 365 organizations without a password
Huntress reported on October 22 that one actor replayed tokens stolen by AiTM and device-code phishing into 79 organizations between July 14 and September 22, r
- BlogDreamHost says File Manager attacker took FTP passwords and webmail sessions for about ten weeks
DreamHost's breach notice, filed with California's attorney general, says an attacker who exploited its web File Manager captured the FTP/SFTP credentials of ev
- BlogGoogle: LLMjacking starts with stolen cloud identities and has cost some companies $1 million
Google Threat Intelligence Group and Mandiant say LLMjacking intrusions ran up more than $100,000 in fraudulent AI charges in a day and $1 million in total at s
- CVEZammad session hijack zero-day that led to remote code execution
A session hijack flaw in Zammad 6.3.0 to 6.5.4 gave attackers code execution as the zammad user. It was exploited against DIVD before disclosure. CISA KEV on Oc
- CVEKeycloak SAML POST-binding XSS via ACS URL
The SAML POST-binding flow reflected a crafted Assertion Consumer Service URL as script. An XSS on the IdP login path is session theft. Patched with the April 2