PT-2025-50552 · Auth0 · Auth0 Next.Js Sdk

Published 2025-12-10 · Updated 2025-12-11 · CVE-2025-67490

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Auth0 Next.js SDK versions 4.11.0 through 4.11.2 and 4.12.0

Description The Auth0 Next.js SDK, a library for user authentication in Next.js applications, has an issue where concurrent requests from the same client can lead to incorrect lookups in the TokenRequestCache for request results.

Recommendations Update to Auth0 Next.js SDK version 4.11.3 or 4.12.1.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-67490

GHSA-WCGJ-F865-C7J7

Affected Products

Auth0 Next.Js Sdk

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67490.json · Exploit
• https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-wcgj-f865-c7j7 · Vendor Advisory
• https://github.com/auth0/nextjs-auth0/commit/26cc8a7c60f4b134700912736f991a25bd6bbf0b · Patch
• https://osv.dev/vulnerability/CVE-2025-67490 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67490 · Security Note
• https://t.me/CVEtracker/39420 · Telegram Post
• https://twitter.com/CVEnew/status/1999108902856929551 · Twitter Post