{"id":"CVE-2025-64762","sourceIdentifier":"security-advisories@github.com","published":"2025-11-21T02:15:44.077","lastModified":"2026-10-07T21:10:00.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication."},{"lang":"es","value":"La biblioteca AuthKit para Next.js proporciona asistentes convenientes para la autenticación y la gestión de sesiones utilizando WorkOS y AuthKit con Next.js. En la versión 2.11.0 y anteriores de authkit-nextjs, las respuestas autenticadas no aplican de forma defensiva encabezados anti-caché. En entornos donde el almacenamiento en caché de CDN está habilitado, esto puede resultar en que los tokens de sesión se incluyan en respuestas almacenadas en caché y posteriormente se sirvan a múltiples usuarios. Las aplicaciones Next.js desplegadas en Vercel no se ven afectadas a menos que habiliten manualmente el almacenamiento en caché de CDN configurando encabezados de caché en rutas autenticadas. Parcheado en authkit-nextjs 2.11.1, que aplica encabezados anti-caché a todas las respuestas detrás de la autenticación."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"workos","product":"authkit-nextjs","versions":[{"version":"< 2.11.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-24T17:03:08.522780Z","id":"CVE-2025-64762","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-524"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:workos:authkit-nextjs:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2.11.1","matchCriteriaId":"C94F2190-CF34-4A96-91A9-01182E2C3993"}]}]}],"references":[{"url":"https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]}]}