GCVE - cpe:2.3:a:workos:authkit-nextjs:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:workos:authkit-nextjs:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Vendor	Workos (`ebfc38e6-f257-5759-b434-60afca4c7f85`)
Product	Authkit Nextjs (`3cfefbed-14fa-5a81-a6dc-6134c459a485`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-64762`	vulnerable	2026-06-08 07:39:20.263420	authkit-nextjs may let session cookies be cached in CDNs The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication. Published: 2025-11-21T01:29:22.606Z Updated: 2025-11-24T18:09:43.225Z Open on db.gcve.eu Reference links https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-51752`	vulnerable	2026-06-08 06:52:12.776786	Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Published: 2024-11-05T19:16:41.831Z Updated: 2024-11-05T20:15:07.923Z Open on db.gcve.eu Reference links https://github.com/workos/authkit-nextjs/security/advisories/GHSA-5wmg-9cvh-qw25 https://github.com/workos/authkit-nextjs/commit/15a332632f7560b03cc6d8cc8da24fd2ac931da7 https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-29901`	vulnerable	2026-06-08 06:33:29.515426	@workos-inc/authkit-nextjs session replay vulnerability MEDIUM (4.8) The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2. Published: 2024-03-29T15:23:02.184Z Updated: 2024-08-02T01:17:58.024Z Open on db.gcve.eu Reference links https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01 https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.