Read the docs
TI-2024-19668 Aliases CVE-2024-29901GHSA-35w3-6qhc-474v

@workos-inc/authkit-nextjs session replay vulnerability

Priority LOW 36CWE-294Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-294.

Summary

The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00659 51st percentileScored 2026-11-07
Fix Fixed authkit-nextjs (workos): 0.4.2@workos-inc/authkit-nextjs (npm): 0.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
workosauthkit-nextjsbefore 0.4.20.4.2Patch availableCNA
—@workos-inc/authkit-nextjs (npm)before 0.4.20.4.2Patch availableGHSA-35w3-6qhc-474v
  • authkit-nextjs Vendorworkos Affected before 0.4.2 Fixed in 0.4.2 Patch available CNA
  • @workos-inc/authkit-nextjs (npm) Vendor— Affected before 0.4.2 Fixed in 0.4.2 Patch available GHSA-35w3-6qhc-474v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:workos:authkit-nextjs:*:*:*:*:*:node.js:*:*before 0.4.2Vulnerableworkos
  • cpe:2.3:a:workos:authkit-nextjs:*:*:*:*:*:node.js:*:* Versions before 0.4.2 Vulnerable ·workos

Remediation

  • Fix · CNA authkit-nextjs (workos) Fixed in 0.4.2
  • Fix · GHSA-35w3-6qhc-474v @workos-inc/authkit-nextjs (npm) Fixed in 0.4.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29901
  2. 2026-10-03 Alias added: GHSA-35w3-6qhc-474v
  3. 2026-10-09 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 2

  • TI-2025-40100 authkit-nextjs may let session cookies be cached in CDNs CVSS 4.0HIGH 8.0
  • TI-2024-34657 Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences