CVE-2025-64762

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-64762
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64762.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-64762
Aliases
Published
2025-11-21T01:29:22.606Z
Modified
2026-03-01T02:54:21.314578Z
Severity
  • 8.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
authkit-nextjs may let session cookies be cached in CDNs
Details

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-524"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64762.json"
}
References

Affected packages

Git / github.com/workos/authkit-nextjs

Affected ranges

Type
GIT
Repo
https://github.com/workos/authkit-nextjs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
928e63075803b6ceee67a607eedf2793738f10be

Affected versions

v0.*
v0.1.0
v0.1.0-rc.0
v0.1.0-rc.1
v0.1.0-rc.2
v0.1.0-rc.3
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.11.2
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.13.0
v0.13.1
v0.13.2
v0.14.0
v0.15.0
v0.16.0
v0.16.1
v0.16.2
v0.17.0
v0.17.1
v0.17.2
v0.2.0
v0.3.0
v0.3.0-rc.0
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.6.0
v0.6.1
v0.6.2
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.4.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.10.0
v2.11.0
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.8.0
v2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64762.json"