CVE-2025-48947: NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
Overview In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers.
Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
1. Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, 2. Applications using CDN or edge caching that caches responses with the Set-Cookie header. 3. If the Cache-Control header is not properly set for sensitive responses.
Fix Upgrade auth0/nextjs-auth0 to v4.6.1.
Other sources
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for someone to be affected by the vulnerability: Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if the Cache-Control header is not properly set for sensitive responses. Users should upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48947?
CVE-2025-48947 is classified as a medium severity vulnerability due to session cookie caching issues.
How do I fix CVE-2025-48947?
To fix CVE-2025-48947, upgrade the Auth0 Next.js SDK to version 4.6.1 or later.
Who is affected by CVE-2025-48947?
Users of Auth0 Next.js SDK versions 4.0.1 to 4.6.0 are affected by CVE-2025-48947.
What are the implications of CVE-2025-48947?
CVE-2025-48947 may expose session cookies to caching mechanisms, potentially leading to session hijacking.
Is there a workaround for CVE-2025-48947 if I cannot upgrade?
There is no official workaround for CVE-2025-48947, so upgrading is the recommended action.