Secuno
ENNL
Book demo

CVE-2025-64762

Workos Authkit-nextjs vulnerability

9.1 CRITICALEPSS 0.37%
  1. Published21 Nov 2025

Description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Workos Authkit-nextjs< 2.11.1

Remediation

Fixed in
Workos Authkit-nextjs≥ 2.11.1

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-618368.6
Directus is a real-time API and App dashboard for managing SQL database content. Prior…
CVE-2026-539439.6
Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind…

Frequently asked

Is CVE-2025-64762 being actively exploited?

CVE-2025-64762 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.37%.

How severe is CVE-2025-64762?

CVE-2025-64762 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.37% probability of exploitation.

Which products are affected by CVE-2025-64762?

Affected products include Workos Authkit-nextjs.

How do I fix CVE-2025-64762?

Upgrade affected software to a fixed version, for example Workos Authkit-nextjs 2.11.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-64762 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.