Use of Web Browser Cache Containing Sensitive Information Affecting @auth0/nextjs-auth0 package, versions >=4.0.1 <4.6.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-AUTH0NEXTJSAUTH0-10302775
- published5 Jun 2025
- disclosed4 Jun 2025
- creditUnknown
Introduced: 4 Jun 2025
NewCVE-2025-48947 (opens in a new tab)How to fix?
Upgrade @auth0/nextjs-auth0 to version 4.6.1 or higher.
Overview
@auth0/nextjs-auth0 is a Next.js SDK for signing in with Auth0
Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the improper setting of __session and Set-Cookie headers in the auth0.middleware. An attacker can intercept and reuse session cookies by exploiting the caching mechanism of CDNs due to missing Cache-Control headers.
Note:
This is only exploitable if applications use CDN or edge caching that caches responses with the Set-Cookie header, and the Cache-Control header is not properly set for sensitive responses.