PT-2026-33516 · Auth0 · Auth0 Next.Js Sdk

Reynaldo Immanuel · Published 2026-04-17 · Updated 2026-04-28 · CVE-2026-40155

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Auth0 Next.js SDK versions 4.12.0 through 4.17.1

Description Simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for token request results. This occurs when projects use the proxy handlers ''/me/'' and ''/my-org/'' with DPoP (Demonstrating Proof-of-Possession, a mechanism that binds a token to a private key) enabled.

Recommendations Update to version 4.18.0.

Fix

Race Condition

Incorrect Authorization

Weakness Enumeration

CWE-362

CWE-863

Related Identifiers

CVE-2026-40155

GHSA-XQ8M-7C5P-C2R6

Affected Products

Auth0 Next.Js Sdk

References · 9

• https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-xq8m-7c5p-c2r6 · Vendor Advisory
• https://github.com/auth0/nextjs-auth0/commit/98c36dc306970c2230ea1a32efef431d29b99978 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40155 · Security Note
• https://osv.dev/vulnerability/GHSA-xq8m-7c5p-c2r6 · Vendor Advisory
• https://github.com/auth0/nextjs-auth0/releases/tag/v4.18.0 · Note
• https://github.com/auth0/nextjs-auth0 · Note
• https://twitter.com/CVEnew/status/2045467393695101169 · Twitter Post
• https://t.me/cveNotify/161143 · Telegram Post
• https://twitter.com/_cvereports/status/2049063860808642929 · Twitter Post