CVE-2025-48947

NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

Published: Jun 4, 2025Updated: Jun 5, 2025 Sources: CVE List NVD GHSACWE-525

N/ACVSS

NVD MITRE

Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for someone to be affected by the vulnerability: Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if the Cache-Control header is not properly set for sensitive responses. Users should upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch.

No summary for this CVE yet.

Weaknesses

CWE-525

Affected Products

auth0

commercialaka auth0.js, login by auth0, nextjs-auth0

nextjs-auth0SaaS

Security Products / identity-access-mgmt

npm

package-ecosystem

@auth0/nextjs-auth0

OSS Libraries

Exploitability

Official Patch Available

References

https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-f3fg-mf2q-fj3f

github.com

https://nvd.nist.gov/vuln/detail/CVE-2025-48947

nvd.nist.gov

https://github.com/auth0/nextjs-auth0/commit/12a62ca596db3b0827b39a4b865b882423e7cb1e

github.com

and 1 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-48947 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows