Medium severity · published Apr 29, 2025
CVE-2025-46344
Auth0 NextJS SDK v4 Missing Session Invalidation
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
nextjs-auth0 · auth0
>= 4.0.1, < 4.5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-46344
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-46344
github.com
https://github.com/auth0/nextjs-auth0/commit/a4f061aed02ffa132feca8adfbd11704df17e1c3
github.com
https://github.com/auth0/nextjs-auth0/releases/tag/v4.5.1
github.com
https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-pjr6-jx7r-j4r6
More from nextjs-auth0
7.7
CVE-2025-48947
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
6.1
CVE-2026-107369
Improper Validation of Post-Login Redirect URL in nextjs-auth0
6.1
CVE-2021-43812
Open redirect in nextjs-auth0
6.1
CVE-2021-32702
Reflected XSS from the callback handler's error query parameter
5.7
CVE-2025-67716
Auth0 Next.js SDK has Improper Validation of Query Parameters