CVE-2025-64762

CVE-2025-64762 is a high-severity security vulnerability in @workos-inc/authkit-nextjs (npm), affecting versions <= 2.11.0. It is fixed in 2.11.1.

Does this CVE actually affect you?

Kodem shows which CVEs are reachable and running in your applications, so you fix what's exploitable, not just what's listed.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Runtime intelligence, not another scanner.

Summary

authkit-nextjs may let session cookies be cached in CDNs

In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users.

Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths.

Notes

Authentication middleware should set anti-caching headers for authenticated routes as a defense in depth measure, but cannot guarantee these headers will not be overwritten elsewhere in the application. We recommend the following:

  • Review your application code, middleware, and infrastructure configuration to ensure the Cache-Control headers set for authenticated paths prevent inappropriate caching
  • For application paths that require caching, do not allow user-specific or sensitive authenticated information to be included in the response data or headers

Impact

This vulnerability may lead to session caching, potentially allowing unauthorized users to obtain another user’s session token. The severity depends on deployment configuration, caching policy, and whether authenticated routes are inadvertently cached.

Affected versions

@workos-inc/authkit-nextjs (<= 2.11.0)

Security releases

@workos-inc/authkit-nextjs → 2.11.1 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environmentNew to Kodem? Get a demo →

Remediation advice

Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.

Frequently Asked Questions

  1. What is CVE-2025-64762? CVE-2025-64762 is a high-severity security vulnerability in @workos-inc/authkit-nextjs (npm), affecting versions <= 2.11.0. It is fixed in 2.11.1.
  2. Which versions of @workos-inc/authkit-nextjs are affected by CVE-2025-64762? @workos-inc/authkit-nextjs (npm) versions <= 2.11.0 is affected.
  3. Is there a fix for CVE-2025-64762? Yes. CVE-2025-64762 is fixed in 2.11.1. Upgrade to this version or later.
  4. Is CVE-2025-64762 exploitable, and should I be worried? Whether CVE-2025-64762 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  5. What actually determines whether CVE-2025-64762 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  6. How do I fix CVE-2025-64762? Upgrade @workos-inc/authkit-nextjs to 2.11.1 or later.

Other vulnerabilities in @workos-inc/authkit-nextjs

Stop the waste.
Protect your environment with Kodem.