Improper Request Caching Lookup in the Auth0 Next.js SDK CVE-2025-67490 - Dec 10, 2025
Description
When using affected versions of the Next.js SDK, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results.
Affected versions
You are affected if you meet the following preconditions:
Applications using the auth0/nextjs-auth0 SDK with a singleton client instance, versions 4.11.0, 4.11.1, and 4.12.0.
Resolution
Upgrade Auth0/nextjs-auth0 version to 4.11.2 or 4.12.1
Acknowledgements
Okta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.
CVE details
CVE ID | |
Published Date | 2025-12-10 |
Vulnerability Type | Incorrect Authorization |
CWE | CWE-863 - Incorrect Authorization |
CVSS v3 | Score: 5.4 Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N |