Executive brief
authkit-nextjs is an authentication library for Next.js applications that handles user login and session management. A vulnerability in versions 2.11.0 and below fails to apply anti-caching headers to authenticated responses, allowing session cookies to be cached by CDNs and served to other users. An attacker could obtain another user's session token, potentially gaining unauthorized access to their account and data.
Technical details
The vulnerability is a credential exposure issue (CWE-524) caused by missing anti-caching headers on authenticated responses in authkit-nextjs versions ≤ 2.11.0. In CDN-enabled environments, authenticated HTTP responses containing session tokens can be cached and subsequently served to other users. The attack requires the application to be deployed with CDN caching enabled on authenticated paths; Next.js applications on Vercel are unaffected unless manually configured to cache authenticated routes. An attacker on the network can retrieve cached responses to obtain session tokens and impersonate legitimate users. The vulnerability is patched in version 2.11.1, which defensively applies Cache-Control headers to all authenticated responses.
Affected products
- WorkOS authkit-nextjs 2.11.0 and below
Timeline
- 2025-11-20: disclosed
- 2025-11-20: patched: Patched in version 2.11.1