CVE-2025-67490: Auth0 Next.js SDK has Improper Request Caching Lookup

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-10 · updated 2026-09-25
Weakness: CWE-863

Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

Affected products

auth0 nextjs-auth0: 4.11.0, 4.11.1, 4.12.0

References

https://github.com/auth0/nextjs-auth0/commit/26cc8a7c60f4b134700912736f991a25bd6bbf0b
https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-wcgj-f865-c7j7

Get alerted when CVE-2025-67490 or the next vulnerability affects your stack