PT-2025-47657 · Unknown+1 · Authkit-Nextjs+1

Published 2025-11-20 · Updated 2025-12-11 · CVE-2025-64762

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions AuthKit-nextjs versions 2.11.0 and below

Description The AuthKit library for Next.js, used for authentication and session management, does not apply anti-caching headers to authenticated responses in versions 2.11.0 and below. This can lead to session tokens being included in cached responses and served to multiple users when CDN caching is enabled. Next.js applications deployed on Vercel are not affected unless CDN caching is manually enabled through cache headers on authenticated paths.

Recommendations Update to AuthKit-nextjs version 2.11.1, which includes anti-caching headers for all responses behind authentication.

Exploit

Fix

Weakness Enumeration

CWE-524

Related Identifiers

BDU:2025-14673

CVE-2025-64762

GHSA-P8PF-44FF-93GF

Affected Products

Authkit-Nextjs

Next.Js

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64762.json · Exploit
• https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea · Patch
• https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf · Patch
• https://bdu.fstec.ru/vul/2025-14673 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64762 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64762 · Vendor Advisory
• https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1 · Note
• https://reddit.com/r/VulnMatter/comments/1p6brge/resumen_diario_de_vulnerabilidades_25112025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1991732199150817431 · Twitter Post
• https://t.me/CVEtracker/37892 · Telegram Post
• https://t.me/cveNotify/145136 · Telegram Post
• https://t.me/cveNotify/145481 · Telegram Post
• https://twitter.com/CVEnew/status/1991729596644127089 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p5nvy1/resumen_diario_de_vulnerabilidades_24112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1p5s47k/resumen_diario_de_vulnerabilidades_24112025 · Reddit Post