Vulnerability · Published Nov 21, 2025 · Assigned by GitHub_M
CVE-2025-64762authkit-nextjs may let session cookies be cached in CDNs
High 8.0
In plain English
A high-severity security flaw in authkit-nextjs from workos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @workos-inc/authkit-nextjs | 2.11.1 | GHSA-p8pf-44ff-93gf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| workos | authkit-nextjs | < 2.11.1 |
Weakness: CWE-524 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U