CVE-2024-29901: Workos Authkit-Nextjs

High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days.

The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.

Affected products

• Workos Authkit-Nextjs: before 0.4.2 (fixed in 0.4.2)

Published 2024-03-29. Last modified 2026-06-17.