Is CVE-2025-64762 actively exploited?

No active exploitation of CVE-2025-64762 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-64762 be exploited remotely?

Yes. CVE-2025-64762 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-64762?

CVE-2025-64762 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2025-64762

CRITICAL

CVE-2025-64762

CWE-524Published: November 21, 2025· Updated: Jun 17, 2026

9.1

CVSS v3.1

Official Description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.

NVD Source

Risk Analysis

A critical vulnerability exists in the AuthKit library for Next.js, specifically in versions up to 2.11.0, where authenticated responses lack anti-caching headers. This can lead to session tokens being cached by CDNs and subsequently served to multiple users, resulting in unauthorized access. The CVSS score of 9.1 highlights the severity of this information disclosure risk.

No public exploits are currently known for this vulnerability. The flaw is remotely exploitable over the network with low complexity.

Recommended Action

Upgrade the authkit-nextjs library to version 2.11.1 or later to ensure anti-caching headers are applied to authenticated responses. If using Next.js on Vercel, ensure CDN caching is not manually enabled on authenticated paths.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-64762 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.