Vulnerability details

CVE-2025-64762

workos authkit-nextjs

authkit-nextjs may let session cookies be cached in CDNs

CVSS 4.0

8.0High

Official description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.

CVSS scores

Score	Version	Source	Vector
8.0High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U`

Affected products

Vendor	Product	Versions	Source
workos	authkit-nextjs	< 2.11.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf x_refsource_CONFIRM
https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea x_refsource_MISC
https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-11-21
Last updated: 2025-11-24
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.39%

Probability of exploitation in 30 days

33.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-524
Use of Cache Containing Sensitive Information