authkit-nextjs vulnerabilities

2 known vulnerabilities in authkit-nextjs from WorkOS. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  authkit-nextjs: Use of Cache Containing Sensitive Information

  CVE-2025-64762Nov 21, 2025WorkOS

  The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In env

• 8.1 High severity

  authkit-nextjs: Authentication Bypass by Capture-replay

  CVE-2024-29901Mar 29, 2024WorkOS

  The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.