CVE-2025-64762

Executive Summary

CVE-2025-64762 is a security vulnerability in the authkit-nextjs library (versions 2.11.0 and below) developed by WorkOS. The flaw arises because authenticated HTTP responses do not include anti-caching headers. In environments where a Content Delivery Network (CDN) or reverse proxy is configured to cache responses, this omission can lead to session tokens being stored in the cache and served to multiple users, resulting in session hijacking and unauthorized access.

The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as High severity due to the potential for session token leakage. The EPSS score is 0.0%, indicating low exploitation probability at this time, but the risk increases in shared hosting or CDN-enabled deployments.

Supply Chain & Package Security

The vulnerable component is an npm package: @workos-inc/authkit-nextjs. Organizations using this package should immediately verify their version and update to 2.11.1 or later. The package is distributed via the npm registry, and supply chain risks include dependency confusion or malicious updates if the package registry is compromised. Always verify package integrity using checksums or signed commits.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the cache.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains within its security boundary.
• Confidentiality (C): High (H) – Session tokens can be exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Overall CVSS Score: 7.5 (High) – Confidentiality impact is high, and the attack is trivial if caching is enabled.

Deep Dive & Mechanics

The authkit-nextjs library is designed to simplify authentication and session management in Next.js applications using WorkOS and AuthKit. When a user authenticates, the library sets a session token (typically a JWT or cookie) in the response. In versions prior to 2.11.1, these responses lack Cache-Control: no-store and Pragma: no-cache headers.

How the vulnerability works:

1. A legitimate user authenticates and receives a response containing a session token.
2. If a CDN or reverse proxy (e.g., Vercel Edge, Cloudflare, Nginx) is configured to cache responses, it may store this response.
3. Another user requests the same resource and receives the cached response, which includes the first user's session token.
4. The second user can then use that token to impersonate the first user.

Affected environments:

• Next.js applications deployed on Vercel are unaffected unless CDN caching is manually enabled on authenticated paths.
• Self-hosted Next.js applications behind a CDN or caching proxy are vulnerable.
• Any deployment where HTTP caching is enabled on authenticated routes.

Vulnerable vs. Patched Code

Vulnerable (version < 2.11.1): The library does not set anti-caching headers on authenticated responses. Example of a vulnerable response:

HTTP/1.1 200 OK
Content-Type: application/json
Set-Cookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Patched (version >= 2.11.1): The library now sets Cache-Control: no-store and Pragma: no-cache headers on all authenticated responses:

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache
Set-Cookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Code diff (conceptual):

// Vulnerable
export function middleware(request) {
  const response = NextResponse.next();
  // No cache headers set
  return response;
}

// Patched
export function middleware(request) {
  const response = NextResponse.next();
  response.headers.set('Cache-Control', 'no-store');
  response.headers.set('Pragma', 'no-cache');
  return response;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Next.js application using authkit-nextjs version < 2.11.1.
• A CDN or caching proxy configured to cache responses (e.g., Cloudflare, Nginx with proxy_cache).
• An authenticated endpoint (e.g., /api/user).

Steps:

1. Identify the target application and confirm it uses the vulnerable library.
2. As a legitimate user, authenticate and capture the session token from the response.
3. Trigger a request to an authenticated endpoint that gets cached by the CDN.
4. As an attacker, request the same endpoint without authentication.
5. If the CDN serves the cached response, extract the session token.
6. Use the token to access protected resources.

Example curl commands:

# Victim authenticates
curl -X POST https://target.com/api/auth/login -d '{"username":"victim","password":"pass"}' -c cookies.txt

# Victim accesses authenticated endpoint (this response gets cached)
curl https://target.com/api/user -b cookies.txt

# Attacker requests the same endpoint without authentication
curl https://target.com/api/user
# If cached, the response includes the victim's session token

Blue Team (Defense & Detection)

Detection:

• Monitor for multiple users receiving the same session token.
• Check CDN logs for cache hits on authenticated endpoints.
• Use the YARA and Sigma rules below to detect missing anti-caching headers.

Prevention:

• Upgrade to authkit-nextjs 2.11.1 or later.
• Configure CDN to bypass caching on authenticated routes (e.g., by cookie or header).
• Implement Cache-Control: no-store on all authenticated responses manually if patching is delayed.

Indicators of Compromise (IOCs)

• Session token reuse: Multiple distinct IP addresses using the same session token.
• Cache hits on authenticated endpoints: CDN logs showing HIT status for URLs that should not be cached.
• Missing cache headers: HTTP responses from authenticated endpoints lacking Cache-Control: no-store or Pragma: no-cache.
• Suspicious user activity: Accounts accessed from unexpected locations without corresponding login events.

Detection Engineering

YARA Rule

rule Detect_Missing_AntiCache_Headers {
    meta:
        description = "Detects HTTP responses missing anti-caching headers on authenticated endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-64762"
    strings:
        $set_cookie = /Set-Cookie:\s*session=/ nocase
        $cache_control = /Cache-Control:\s*no-store/ nocase
        $pragma = /Pragma:\s*no-cache/ nocase
    condition:
        $set_cookie and not ($cache_control or $pragma)
}

Sigma Rule

title: Missing Anti-Caching Headers on Authenticated Responses
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP responses with Set-Cookie but without Cache-Control: no-store or Pragma: no-cache headers.
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: proxy
detection:
    selection:
        response_headers|contains: 'Set-Cookie: session='
    exclusion:
        response_headers|contains|all:
            - 'Cache-Control: no-store'
            - 'Pragma: no-cache'
    condition: selection and not exclusion
falsepositives:
    - Non-authenticated endpoints that set cookies for other purposes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64762 - Missing Anti-Caching Headers on Authenticated Response"; flow:to_client; content:"Set-Cookie: session="; http_header; nocase; pcre:"/Cache-Control:\s*no-store/"; pcre:"/Pragma:\s*no-cache/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade @workos-inc/authkit-nextjs to version 2.11.1 or later.
2. If upgrade is not possible, manually add anti-caching headers in your Next.js middleware:

   export function middleware(request) {
     const response = NextResponse.next();
     response.headers.set('Cache-Control', 'no-store');
     response.headers.set('Pragma', 'no-cache');
     return response;
   }
   

3. Configure CDN to bypass caching on any route that sets session cookies.

Long-term:

• Implement a Content Security Policy (CSP) to mitigate token leakage via XSS.
• Regularly audit dependencies for known vulnerabilities.
• Use automated tools (e.g., npm audit, Snyk) to detect vulnerable packages.

Workarounds:

• Disable CDN caching entirely for authenticated paths.
• Use a reverse proxy (e.g., Nginx) to strip cache headers on responses containing Set-Cookie.

Valters IT
DevSecOps & Cyber Threat Intelligence