Improper Proxy Cache Lookup in the Auth0 Next.js SDK CVE-2026-40155 - Apr 17, 2026

Description

In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.

Affected versions

You are affected if you meet all of the following preconditions:

Applications using the auth0/nextjs-auth0 SDK, versions 4.12.0 to 4.17.0, and
Applications using the proxy handler /me/* and /my-org/* with DPoP enabled.

Resolution

Upgrade Auth0/nextjs-auth0 version to version 4.18.0 or greater

Acknowledgements

Okta would like to thank Reynaldo Immanuel for their discovery and responsible disclosure.

CVE details

CVE ID	CVE-2026-40155
Published Date	2026-04-17
Vulnerability Type	Incorrect Authorization
CWE	CWE-863 - Incorrect Authorization
CVSS v3	Score: 5.4 Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

References

Improper Proxy Cache Lookup in the Auth0 Next.js SDK