Authkit-nextjs versions 2.11.0 and below do not apply anti-caching headers on authenticated responses, which can cause session tokens to be cached by CDNs and served to unauthorized users. This issue is fixed in version 2.11.1 by adding anti-caching headers. The vulnerability primarily affects deployments that enable CDN caching on authenticated routes. Next.js apps on Vercel are not affected unless CDN caching is manually enabled on authenticated paths.