PT-2025-23857 · Auth0 · Auth0 Next.Js Sdk
Femiajiboye-Okta
·
Published
2025-06-04
·
Updated
2025-06-05
·
CVE-2025-48947
CVSS v4.0
7.7
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |
Name of the Vulnerable Software and Affected Versions
Auth0 Next.js SDK versions 4.0.1 through 4.6.0
Description
The issue concerns the caching of
session cookies set by auth0.middleware in CDN environments due to missing Cache-Control headers. Three preconditions must be met for the vulnerability to be exploited: the application must use the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, use CDN or edge caching that caches responses with the Set-Cookie header, and the Cache-Control header must not be properly set for sensitive responses.Recommendations
For Auth0 Next.js SDK versions 4.0.1 through 4.6.0, upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch. As a temporary workaround, consider ensuring the Cache-Control header is properly set for sensitive responses to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Auth0 Next.Js Sdk