Executive brief
The Auth0 NextJS SDK is used by web applications to manage user authentication and sessions. A flaw in versions 4.0.1 through 4.5.0 causes session tokens to lack expiration claims, allowing attackers with valid JWE tokens to maintain session access even after the session cookie expires or is cleared by administrators or users.
Technical details
The vulnerability is a missing session invalidation issue (CWE-613) where the Auth0 NextJS SDK fails to invoke .setExpirationTime when generating JWE tokens for sessions. As a result, the JWE lacks an internal expiration claim. While the session cookie may expire or be cleared at the application level, the underlying JWE token remains valid indefinitely. An attacker who obtains a valid JWE token can replay it after normal session expiration to regain access. This requires knowledge of a valid JWE token but no additional authentication. The fix is available in v4.5.1 and later.
Affected products
- Auth0 NextJS SDK 4.0.1 to 4.5.0
Timeline
- 2025-04-29: disclosed
- 2025-04-29: patched: Version 4.5.1 released with fix