Critical · published November 21, 2025
⚡ A missed anti-caching header could let session tokens slip from one user to another! That's right, if you're using authkit-nextjs version 2.11.0 or below, you're risking a major mix-up! 🔥 Think of it like a restaurant where a server mistakenly serves the same meal to multiple tables without checking whose order is whose. If customers aren't careful, they might end up with someone else's dish and their secret ingredient! 🍽️ This flaw can lead to unauthorized access, as users may inadvertently receive another user's session token. Imagine the chaos when sensitive information is served on a silver platter to the wrong person! Attackers could exploit this mix-up to gain access to private areas of your application. Yikes! 😱
Think of it like a restaurant where a server mistakenly serves the same meal to multiple tables without checking whose order is whose. If customers aren't careful, they might end up with someone else's dish and their secret ingredient! 🍽️ In authkit-nextjs versions 2.11.0 and below, authenticated responses lack anti-caching headers, allowing sensitive session tokens to be cached and served to multiple authenticated users. This flaw occurs in environments where CDN caching is enabled.
This flaw can lead to unauthorized access, as users may inadvertently receive another user's session token. Imagine the chaos when sensitive information is served on a silver platter to the wrong person! Attackers could exploit this mix-up to gain access to private areas of your application. Yikes! 😱 Upgrade to authkit-nextjs version 2.11.1 or above immediately to ensure anti-caching headers are applied correctly. Review your caching strategy and avoid setting cache headers on authenticated paths to prevent this from happening in the future. 🛡️ This is fixable! With these updates, you’ll have your authentication flows locked down tighter than a drum. You've got this! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| workos/authkit-nextjs | < 2.11.1 | 2.11.1 |