Executive brief
The Auth0 NextJS-Auth0 SDK is a library that manages user authentication for web applications built with Next.js. In affected versions, session cookies are not properly protected with cache-control headers, allowing content delivery networks (CDNs) to cache and serve them to unintended users. An attacker could intercept these cached cookies to impersonate legitimate users and gain unauthorized access to applications.
Technical details
The vulnerability exists in Auth0 NextJS-Auth0 SDK versions 4.0.1 through 4.6.0, where the auth0.middleware fails to set appropriate Cache-Control headers on responses containing __session cookies. This allows intermediate CDN or edge-caching infrastructure to cache the Set-Cookie header, which can then be served to other users. The attack requires the vulnerable SDK version, an application configured with CDN caching, and the attacker's ability to interact with the CDN edge (through passive user interaction). An attacker can obtain valid session cookies from the cache and use them for session hijacking. The vulnerability is fixed in version 4.6.1.
Affected products
- Auth0 NextJS-Auth0 SDK 4.0.1 to 4.6.0
Timeline
- 2025-06-04: disclosed
- 2025-06-04: patched: Version 4.6.1