CVE-2025-64762 authkit-nextjs may let session cookies be cached in CDNs
Attackers can steal session tokens if CDN caching is enabled, as the library fails to set anti-caching headers on authenticated responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64762?
CVE-2025-64762 is a high-severity vulnerability in workos authkit-nextjs, published on 21 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.
Weakness: CWE-524
Which versions are affected by CVE-2025-64762?
2 open source packages ship an affected version, including @workos-inc/authkit-nextjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@workos-inc/authkit-nextjs npm | All versions | 2.11.1 |
@workos-inc/authkit-nextjs npm | All versions | 2.11.1 |
Products include Workos Authkit-Nextjs.
How do I fix CVE-2025-64762?
Upgrade @workos-inc/authkit-nextjs to 2.11.1 or later.
Is CVE-2025-64762 being exploited?
There is no known exploitation of CVE-2025-64762 in the wild and no public exploit code.
Other vulnerabilities in workos authkit-nextjs
Sources
Also known as GHSA-p8pf-44ff-93gf.