Vulnerability · Published Apr 29, 2025 · Assigned by GitHub_M
CVE-2025-46344Auth0 NextJS SDK v4 Missing Session Invalidation
Medium 4.9
In plain English
A medium-severity security flaw in nextjs-auth0 from auth0. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @auth0/nextjs-auth0 | 4.5.1 | GHSA-pjr6-jx7r-j4r6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| auth0 | nextjs-auth0 | >= 4.0.1, < 4.5.1 |
Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U