HomepageOkta logo

Improper Request Caching Lookup in the Auth0 Next.js SDK CVE-2025-67490 - Dec 10, 2025

View all security advisories

Description

When using affected versions of the Next.js SDK, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results.

Affected versions

You are affected if you meet the following preconditions:

  • Applications using the auth0/nextjs-auth0 SDK with a singleton client instance, versions 4.11.0, 4.11.1, and 4.12.0.

Resolution

Upgrade Auth0/nextjs-auth0 version to 4.11.2 or 4.12.1

Acknowledgements

Okta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.

CVE details

CVE ID

CVE-2025-67490

Published Date

2025-12-10

Vulnerability Type

Incorrect Authorization

CWE

CWE-863 - Incorrect Authorization

CVSS v3

Score: 5.4

Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

References

Improper Request Caching Lookup in the Auth0 Next.js SDK