[m0tzy]

Summary

AuthKitCore.verifyToken, which validateAndRefresh uses, only ran jwtVerify (signature, exp, and iss when configured). It didn't check that the token was a user session access token, so other token types signed by the same environment key were accepted as a session.

const { payload } = await jwtVerify(token, this.getPublicKey(), issuer ? { issuer } : undefined);
return isUserAccessTokenPayload(payload);
// typeof sid === 'string' && typeof auth_time === 'number'
// && (sub_profile === undefined || sub_profile === 'user') && sub_type === undefined

This matches hasRequiredAccessTokenClaims in @workos-inc/node. sub_profile is optional on user access tokens, so a missing claim is still accepted. Adapters built on authkit-session pick this up when they upgrade.

TokenManager.verifyToken has the same plain jwtVerify, but nothing in src uses it outside its own spec, so this PR leaves it alone.

Tests: AuthKitCore.verifyToken() token claims in AuthKitCore.issuer.spec.ts covers sub_profile: ai_agent, sub_type: authkit, a missing or string auth_time, and a missing or numeric sid, plus sub_profile: user as the positive case. All 6 rejection cases fail without the AuthKitCore.ts change. The spec's default mocked payload now carries sid/auth_time.

Link to Devin session: https://app.devin.ai/sessions/7e123fc2545a49c282b043a4abd58f70
Open in Devin Desktop: https://app.devin.ai/desktop/session/7e123fc2545a49c282b043a4abd58f70?variant=devin
Requested by: @m0tzy

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from madison.packer

What's the fix here? https://linear.app/workos/issue/VULN-4839/lt-app26-10-user-vs-agent-jwt-type-confusion

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Devin Review

🟢 Devin Review found nothing to fix · View findings

[greptile-apps]

Confidence Score: 5/5

[Critical impact] This PR appears safe to merge.

Summary

AuthKitCore.verifyToken now checks that signed tokens have user-session claims.

• Session checks accept only user access tokens.

No new actionable issues were found. Tests were not run during this review.

_{Reviews (2) · Last reviewed commit: "test: Authenticate again with the refres..." · Reviewed by Greptile}

[devin-ai-integration]

@greptileai review