Is CVE-2025-46344 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-46344 being exploited in the wild.

How severe is CVE-2025-46344?

Medium severity, with a CVSS score of 4, published 29 April 2025.

Which products and versions are affected?

Auth0 NextJS SDK 4.0.1 to 4.5.0; @auth0/nextjs-auth0 (npm) SEMVER:introduced=4.0.1,fixed=4.5.1.

Is there a fix for CVE-2025-46344?

Yes. @auth0/nextjs-auth0 (npm): upgrade to 4.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-46344 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-46344?

Check whether you run Auth0 NextJS SDK or @auth0/nextjs-auth0 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-46344: Auth0 NextJS SDK missing session invalidation

CVE-2025-46344 · Severity: medium · CVSS 4 · Published 2025-04-29

The Auth0 NextJS SDK is used by web applications to manage user authentication and sessions. A flaw in versions 4.0.1 through 4.5.0 causes session tokens to lack expiration claims, allowing attackers with valid JWE tokens to maintain session access even after the session cookie expires or is cleared by administrators or users.

Technologies: @auth0/nextjs-auth0 (npm). Vendors: Auth0, npm.

Quick answers

Is CVE-2025-46344 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-46344 being exploited in the wild.
How severe is CVE-2025-46344?: Medium severity, with a CVSS score of 4, published 29 April 2025.
Which products and versions are affected?: Auth0 NextJS SDK 4.0.1 to 4.5.0; @auth0/nextjs-auth0 (npm) SEMVER:introduced=4.0.1,fixed=4.5.1.
Is there a fix for CVE-2025-46344?: Yes. @auth0/nextjs-auth0 (npm): upgrade to 4.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-46344 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-46344?: Check whether you run Auth0 NextJS SDK or @auth0/nextjs-auth0 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@auth0/nextjs-auth0 (npm): upgrade to 4.5.1 or later
```
npm install @auth0/nextjs-auth0@4.5.1
```

Technical details

The vulnerability is a missing session invalidation issue (CWE-613) where the Auth0 NextJS SDK fails to invoke .setExpirationTime when generating JWE tokens for sessions. As a result, the JWE lacks an internal expiration claim. While the session cookie may expire or be cleared at the application level, the underlying JWE token remains valid indefinitely. An attacker who obtains a valid JWE token can replay it after normal session expiration to regain access. This requires knowledge of a valid JWE token but no additional authentication. The fix is available in v4.5.1 and later.

Affected products

Auth0 NextJS SDK 4.0.1 to 4.5.0

Identifiers

CVE-2025-46344
GHSA-pjr6-jx7r-j4r6

Timeline

2025-04-29: disclosed
2025-04-29: patched: Version 4.5.1 released with fix

References

https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-pjr6-jx7r-j4r6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.