Vulnerability in Workos Authkit-Nextjs
CVE-2025-64762
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (28.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 28.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Workos Authkit-Nextjs — versions < 2.11.1
Weakness classification (CWE)
References
- github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf (Patch, Third Party Advisory)
- github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea (Patch)
- github.com/workos/authkit-nextjs/releases/tag/v2.11.1 (Release Notes)
Frequently asked questions
- What is CVE-2025-64762?
- CVE-2025-64762 is a critical-severity vulnerability in Workos Authkit-Nextjs, classified under Use of Cache Containing Sensitive Information. CVSS score: 9.1/10. Published 2025-11-21.
- How severe is CVE-2025-64762?
- Critical severity. CVSS v3 base score is 9.1 out of 10.