CVE-2025-64762: authkit-nextjs — Fix

Description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.

Is your site exposed to CVE-2025-64762?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

CWE-524 CWE-524

Affected Products

Vendor	Product	Versions
workos	authkit-nextjs	< 2.11.1

References

Advisories & Patches

https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf

Other References

https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1

Frequently Asked Questions

What is CVE-2025-64762? +

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication. It has a CVSS v3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2025-64762? +

CVE-2025-64762 has a CVSS v3.1 score of 9.1 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2025-64762? +

CVE-2025-64762 affects products from workos, specifically: authkit-nextjs. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-64762? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-4233

An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control …

CVE-2026-47225

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is a cache isolation issue affecting …

CVE-2026-53943 9.6

Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results …

CVE-2026-61836 8.6

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is …

CVE-2026-48901 7.5

The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.

CVE-2024-27917 7.5

Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie …

CVE-2025-64762