CVE-2025-64762

{"id": "CVE-2025-64762", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64762", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-24T17:03:08.522780Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "workos", "product": "authkit-nextjs", "versions": [{"status": "affected", "version": "< 2.11.1"}]}]}], "published": "2025-11-21T02:15:44.077", "references": [{"url": "https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-524"}]}], "descriptions": [{"lang": "en", "value": "The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication."}, {"lang": "es", "value": "La biblioteca AuthKit para Next.js proporciona asistentes convenientes para la autenticaci\u00f3n y la gesti\u00f3n de sesiones utilizando WorkOS y AuthKit con Next.js. En la versi\u00f3n 2.11.0 y anteriores de authkit-nextjs, las respuestas autenticadas no aplican de forma defensiva encabezados anti-cach\u00e9. En entornos donde el almacenamiento en cach\u00e9 de CDN est\u00e1 habilitado, esto puede resultar en que los tokens de sesi\u00f3n se incluyan en respuestas almacenadas en cach\u00e9 y posteriormente se sirvan a m\u00faltiples usuarios. Las aplicaciones Next.js desplegadas en Vercel no se ven afectadas a menos que habiliten manualmente el almacenamiento en cach\u00e9 de CDN configurando encabezados de cach\u00e9 en rutas autenticadas. Parcheado en authkit-nextjs 2.11.1, que aplica encabezados anti-cach\u00e9 a todas las respuestas detr\u00e1s de la autenticaci\u00f3n."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:workos:authkit-nextjs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "C94F2190-CF34-4A96-91A9-01182E2C3993", "versionEndExcluding": "2.11.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}