TI-2025-31085 Aliases CVE-2025-48947 GHSA-f3fg-mf2q-fj3f

NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

LOW 34CWE-525Published 2025-06-04 · Updated 2025-06-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for someone to be affected by the vulnerability: Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if the Cache-Control header is not properly set for sensitive responses. Users should upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00435 38th percentileScored 2026-11-07

Fix Fixed nextjs-auth0 (auth0): 4.6.1@auth0/nextjs-auth0 (npm): 4.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
auth0	nextjs-auth0	4.0.1 to before 4.6.1	4.6.1	Patch available	CNA
—	@auth0/nextjs-auth0 (npm)	4.0.1 to before 4.6.1	4.6.1	Patch available	GHSA-f3fg-mf2q-fj3f

nextjs-auth0 Vendorauth0 Affected 4.0.1 to before 4.6.1 Fixed in 4.6.1 Patch available CNA
@auth0/nextjs-auth0 (npm) Vendor— Affected 4.0.1 to before 4.6.1 Fixed in 4.6.1 Patch available GHSA-f3fg-mf2q-fj3f

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:auth0:nextjs-auth0::::::::	—	—	auth0

cpe:2.3:a:auth0:nextjs-auth0:*:*:*:*:*:*:*:* Versions — — ·auth0

Remediation

Fix · CNA nextjs-auth0 (auth0) Fixed in 4.6.1
Fix · GHSA-f3fg-mf2q-fj3f @auth0/nextjs-auth0 (npm) Fixed in 4.6.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-48947
2026-10-03 Alias added: GHSA-f3fg-mf2q-fj3f

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-48947

Other 3

TI-2015-07615 Improper input validation in HackerOne jsonwebtoken node module CVSS 3.0CRITICAL 9.8
TI-2025-29805 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVSS 3.1CRITICAL 9.1
TI-2025-31089 Auth0-PHP SDK Deserialization of Untrusted Data vulnerability CVSS 4.0CRITICAL 9.3
TI-2020-06427 An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. CVSS 3.1CRITICAL 9.8
TI-2018-05020 The Auth0 authentication service before 2017-10-15 allows privilege escalation because… CVSS 3.0CRITICAL 9.8
TI-2019-05387 Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error… CVSS 3.0CRITICAL 9.8

See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences