CVE-2025-64762

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.

• CWE-524

• https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15eaPatch
• https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1Release Notes
• https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gfPatch, Third Party Advisory

Published

Nov 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64757Astro is a web framework. Prior to version 5.14.3, a vulnera…3.5
• CVE-2025-64758@dependencytrack/frontend is a Single Page Application (SPA)…4.8
• CVE-2025-64759Homarr is an open-source dashboard. Prior to version 1.43.3,…6.1
• CVE-2025-6476A vulnerability was found in SourceCodester Gym Management S…4.3
• CVE-2025-64760Tuleap is a free and open source suite for management of sof…4.3
• CVE-2025-64761OpenBao is an open source identity-based secrets management …7.2
• CVE-2025-64763Envoy is a high-performance edge/middle/service proxy. In 1.…5.3
• CVE-2025-64764Astro is a web framework. Prior to version 5.15.8, a reflect…5.4
• CVE-2025-64765Astro is a web framework. Prior to version 5.15.8, a mismatc…5.3
• CVE-2025-64766NixOS's Onlyoffice is a software suite that offers online an…5.3
• CVE-2025-64767hpke-js is a Hybrid Public Key Encryption (HPKE) module buil…9.1
• CVE-2025-64769The Process Optimization application suite leverages connect…7.6