authkit-nextjs may let session cookies be cached in CDNs

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-64762 · Microsoft / collected KEV context

EUVD-2025-198354

GHSA-p8pf-44ff-93gf

cve-program · CVE-2025-64762

• https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf
• https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea
• https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1

euvd · EUVD-2025-198354

• https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf
• https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea
• https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1

nvd · CVE-2025-64762

• https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea
• https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1
• https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf

osv · GHSA-p8pf-44ff-93gf

• https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf
• https://nvd.nist.gov/vuln/detail/CVE-2025-64762
• https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea
• https://github.com/workos/authkit-nextjs
• https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1

No related operational record is retained in the current change model.