Is CVE-2025-64762 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64762 being exploited in the wild.

How severe is CVE-2025-64762?

Critical severity, with a CVSS score of 9.1, published 21 November 2025.

Which products and versions are affected?

@workos-inc/authkit-nextjs (npm) SEMVER:introduced=0,fixed=2.11.1; WorkOS Authkit-Nextjs 2.11.0 and below.

Is there a fix for CVE-2025-64762?

Yes. @workos-inc/authkit-nextjs (npm): upgrade to 2.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64762 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-64762?

Check whether you run @workos-inc/authkit-nextjs (npm) or WorkOS Authkit-Nextjs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64762: WorkOS authkit-nextjs session cookie caching in CDNs

CVE-2025-64762 · Severity: critical · CVSS 9.1 · Published 2025-11-21

authkit-nextjs is an authentication library for Next.js applications that handles user login and session management. A vulnerability in versions 2.11.0 and below fails to apply anti-caching headers to authenticated responses, allowing session cookies to be cached by CDNs and served to other users. An attacker could obtain another user's session token, potentially gaining unauthorized access to their account and data.

Technologies: @workos-inc/authkit-nextjs (npm). Vendors: npm, WorkOS.

Quick answers

Is CVE-2025-64762 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64762 being exploited in the wild.
How severe is CVE-2025-64762?: Critical severity, with a CVSS score of 9.1, published 21 November 2025.
Which products and versions are affected?: @workos-inc/authkit-nextjs (npm) SEMVER:introduced=0,fixed=2.11.1; WorkOS Authkit-Nextjs 2.11.0 and below.
Is there a fix for CVE-2025-64762?: Yes. @workos-inc/authkit-nextjs (npm): upgrade to 2.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64762 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-64762?: Check whether you run @workos-inc/authkit-nextjs (npm) or WorkOS Authkit-Nextjs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@workos-inc/authkit-nextjs (npm): upgrade to 2.11.1 or later
```
npm install @workos-inc/authkit-nextjs@2.11.1
```

Technical details

The vulnerability is a credential exposure issue (CWE-524) caused by missing anti-caching headers on authenticated responses in authkit-nextjs versions ≤ 2.11.0. In CDN-enabled environments, authenticated HTTP responses containing session tokens can be cached and subsequently served to other users. The attack requires the application to be deployed with CDN caching enabled on authenticated paths; Next.js applications on Vercel are unaffected unless manually configured to cache authenticated routes. An attacker on the network can retrieve cached responses to obtain session tokens and impersonate legitimate users. The vulnerability is patched in version 2.11.1, which defensively applies Cache-Control headers to all authenticated responses.

Affected products

WorkOS authkit-nextjs 2.11.0 and below

Identifiers

CVE-2025-64762
GHSA-p8pf-44ff-93gf

Timeline

2025-11-20: disclosed
2025-11-20: patched: Patched in version 2.11.1

References

https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.