Read the docs
TI-2025-40100 Aliases CVE-2025-64762GHSA-p8pf-44ff-93gf

authkit-nextjs may let session cookies be cached in CDNs

Priority MEDIUM 43CWE-524Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00393 33rd percentileScored 2026-11-07
Fix Fixed authkit-nextjs (workos): 2.11.1@workos-inc/authkit-nextjs (npm): 2.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
workosauthkit-nextjsbefore 2.11.12.11.1Patch availableCNA
—@workos-inc/authkit-nextjs (npm)before 2.11.12.11.1Patch availableGHSA-p8pf-44ff-93gf
  • authkit-nextjs Vendorworkos Affected before 2.11.1 Fixed in 2.11.1 Patch available CNA
  • @workos-inc/authkit-nextjs (npm) Vendor— Affected before 2.11.1 Fixed in 2.11.1 Patch available GHSA-p8pf-44ff-93gf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:workos:authkit-nextjs:*:*:*:*:*:node.js:*:*before 2.11.1Vulnerableworkos
  • cpe:2.3:a:workos:authkit-nextjs:*:*:*:*:*:node.js:*:* Versions before 2.11.1 Vulnerable ·workos

Remediation

  • Fix · CNA authkit-nextjs (workos) Fixed in 2.11.1
  • Fix · GHSA-p8pf-44ff-93gf @workos-inc/authkit-nextjs (npm) Fixed in 2.11.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64762
  2. 2026-10-03 Alias added: GHSA-p8pf-44ff-93gf

References

Patch 2

Advisory 1

Other 2

  • TI-2024-19668 @workos-inc/authkit-nextjs session replay vulnerability CVSS 3.1HIGH 8.1
  • TI-2024-34657 Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences