CVE-2025-48947 - CVE House
Back to Database
Status published High CVE-2025-48947

NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

Vulnerability Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for someone to be affected by the vulnerability: Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if the Cache-Control header is not properly set for sensitive responses. Users should upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48947

Credits & Attribution

No credits recorded in the NVD database.

References

More from auth0

View All →
CVE-2025-68129
Auth0-PHP SDK has Improper Audience Validation
Medium 6.8
CVE-2025-67716
Auth0 Next.js SDK has Improper Validation of Query Parameters
Medium 5.7
CVE-2025-67490
Auth0 Next.js SDK has Improper Request Caching Lookup
Medium 5.4
CVE-2025-65945
auth0/node-jws improper HMAC signature verification vulnerability
High 7.5
CVE-2025-58769
auth0-PHP: Improper File Type Handling in Bulk User Import
Low 3.3

Affected Vendor

Affected Software

nextjs-auth0
Vulnerable Versions:
>= 4.0.1, < 4.6.1

Timeline

Official Publish: June 4th, 2025
Last Modified: June 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-525

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.