Description
A user can reuse an expired session by controlling the x-workos-session header.
Recommendation
Update the @workos-inc/authkit-nextjs package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.4.2
- Patched version(s): 0.4.2
References
Related Issues
- @workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled - CVE-2024-51752
- @workos-inc/authkit-remix refresh tokens are logged when the debug flag is enabled - CVE-2024-51753
- authkit-nextjs may let session cookies be cached in CDNs - CVE-2025-64762
- Stimulsoft Dashboard.JS Cross Site Scripting vulnerability - CVE-2024-24396
- Tags:
- npm
- @workos-inc/authkit-nextjs
Anything's wrong? Let us know Last updated on March 29, 2024