GitHub Advisoryadvisory · npm

GHSA-pjr6-jx7r-j4r6 Auth0 NextJS SDK v4 Missing Session Invalidation

MEDIUM Published 2025-04-29 Modified 2025-04-30 Official page ↗
Aliases
CVE-2025-46344
Ecosystem
npm
Packages
@auth0/nextjs-auth0
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-613
Reviewed
2025-04-29

Affected packages

• npm @auth0/nextjs-auth0: >= 4.0.1, < 4.5.1 → fixed in 4.5.1

Description

Overview Auth0 NextJS `v4.0.1` to `v4.5.0` does not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. Am I Affected? You are affected if you are using Auth0 NextJS SDK v4. Fix Upgrade to `v4.5.1`.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2025-46344 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. vulnerability

References