CVE-2025-64762
📋 TL;DR
The AuthKit library for Next.js versions 2.11.0 and below fails to apply anti-caching headers to authenticated responses. This allows session tokens to be cached by CDNs and served to multiple users, potentially enabling session hijacking. Applications using authkit-nextjs with CDN caching enabled on authenticated paths are affected.
💻 Affected Systems
- authkit-nextjs
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers can hijack authenticated user sessions, gaining unauthorized access to sensitive data and functionality, potentially leading to account takeover and data breaches.
Likely Case
Session tokens leak through CDN caching, allowing unauthorized users to access other users' authenticated sessions and data.
If Mitigated
With proper anti-caching headers, authenticated responses are not cached, preventing session token leakage.
🎯 Exploit Status
Exploitation requires CDN caching to be enabled on authenticated paths and an attacker to access cached responses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.1
Vendor Advisory: https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf
Restart Required: No
Instructions:
1. Update authkit-nextjs to version 2.11.1 or higher. 2. Run npm update authkit-nextjs or yarn upgrade authkit-nextjs. 3. Deploy the updated application.
🔧 Temporary Workarounds
Manually add anti-caching headers
allAdd anti-caching headers to authenticated responses in your Next.js application.
// In your Next.js API routes or middleware, add headers: Cache-Control: no-store, no-cache, must-revalidate, private
Disable CDN caching on authenticated paths
allConfigure your CDN or deployment platform to disable caching for authenticated routes.
🧯 If You Can't Patch
- Disable CDN caching for all authenticated paths in your deployment configuration.
- Implement additional session validation and monitoring to detect unauthorized access.
🔍 How to Verify
Check if Vulnerable:
Check your package.json for authkit-nextjs version 2.11.0 or below and verify if CDN caching is enabled on authenticated paths.Check Version:
npm list authkit-nextjsVerify Fix Applied:
Verify authkit-nextjs version is 2.11.1 or higher and test authenticated responses to confirm Cache-Control headers are present.📡 Detection & Monitoring
Log Indicators:
- Multiple users accessing the same session token
- Unauthorized access attempts from unexpected IPs
Network Indicators:
- Cache-Control headers missing from authenticated responses
- CDN cache hits on authenticated paths
SIEM Query:
search for multiple user sessions with identical tokens or access from diverse IPs within short timeframes