TI-2025-29085 Aliases CVE-2025-46344 GHSA-pjr6-jx7r-j4r6

Auth0 NextJS SDK v4 Missing Session Invalidation

LOW 23CWE-613Published 2025-04-29 · Updated 2025-04-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00438 38th percentileScored 2026-11-07

Fix Fixed nextjs-auth0 (auth0): 4.5.1@auth0/nextjs-auth0 (npm): 4.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
auth0	nextjs-auth0	4.0.1 to before 4.5.1	4.5.1	Patch available	CNA
—	@auth0/nextjs-auth0 (npm)	4.0.1 to before 4.5.1	4.5.1	Patch available	GHSA-pjr6-jx7r-j4r6

nextjs-auth0 Vendorauth0 Affected 4.0.1 to before 4.5.1 Fixed in 4.5.1 Patch available CNA
@auth0/nextjs-auth0 (npm) Vendor— Affected 4.0.1 to before 4.5.1 Fixed in 4.5.1 Patch available GHSA-pjr6-jx7r-j4r6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:auth0:nextjs-auth0::::::::	—	—	auth0

cpe:2.3:a:auth0:nextjs-auth0:*:*:*:*:*:*:*:* Versions — — ·auth0

Remediation

Fix · CNA nextjs-auth0 (auth0) Fixed in 4.5.1
Fix · GHSA-pjr6-jx7r-j4r6 @auth0/nextjs-auth0 (npm) Fixed in 4.5.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-46344
2026-10-03 Alias added: GHSA-pjr6-jx7r-j4r6

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-46344

Other 4

TI-2015-07615 Improper input validation in HackerOne jsonwebtoken node module CVSS 3.0CRITICAL 9.8
TI-2025-29805 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVSS 3.1CRITICAL 9.1
TI-2025-31089 Auth0-PHP SDK Deserialization of Untrusted Data vulnerability CVSS 4.0CRITICAL 9.3
TI-2020-06427 An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. CVSS 3.1CRITICAL 9.8
TI-2018-05020 The Auth0 authentication service before 2017-10-15 allows privilege escalation because… CVSS 3.0CRITICAL 9.8
TI-2019-05387 Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error… CVSS 3.0CRITICAL 9.8

See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences