CDN Caching of Session Cookies in NextJS-Auth0 SDK CVE-2025-48947 - Jun 3, 2025
Description
In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, __session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers.
Affected versions
You are affected if you meet the following preconditions:
Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0,
Applications using CDN or edge caching that caches responses with the Set-Cookie header.
If the Cache-Control header is not properly set for sensitive responses.
Fix
Upgrade auth0/nextjs-auth0 to version 4.6.1.
CVE details
CVE ID | |
Published Date | 2025-06-03 |
Vulnerability Type | Missing Cache-Control Headers |
CWE | CWE-525 - Use of Web Browser Cache Containing Sensitive Information |
CVSS v4 | Score: 7.7 Vector string: https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |