CVE-2025-64762
CriticalSummary
The AuthKit library for Next.js in version 2.11.0 and below does not defensively apply anti-caching headers to authenticated responses. In environments with CDN caching enabled, this can result in session tokens being included in cached responses and served to multiple users.
Risk Assessment
The risk includes leakage of session tokens to other users, potentially leading to session hijacking and unauthorized account access.
Recommendation
Update authkit-nextjs to version 2.11.1 or later and avoid manually enabling CDN caching on authenticated paths.
Original NVD description (English source)
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.