Is CVE-2025-48947 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-48947 being exploited in the wild.

How severe is CVE-2025-48947?

Medium severity, with a CVSS score of 4, published 4 June 2025.

Which products and versions are affected?

Auth0 NextJS-Auth0 SDK 4.0.1 to 4.6.0; @auth0/nextjs-auth0 (npm) SEMVER:introduced=4.0.1,fixed=4.6.1.

Is there a fix for CVE-2025-48947?

Yes. @auth0/nextjs-auth0 (npm): upgrade to 4.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-48947 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-48947?

Check whether you run Auth0 NextJS-Auth0 SDK or @auth0/nextjs-auth0 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-48947: Auth0 NextJS-Auth0 SDK CDN caching of session cookies

CVE-2025-48947 · Severity: medium · CVSS 4 · Published 2025-06-04

The Auth0 NextJS-Auth0 SDK is a library that manages user authentication for web applications built with Next.js. In affected versions, session cookies are not properly protected with cache-control headers, allowing content delivery networks (CDNs) to cache and serve them to unintended users. An attacker could intercept these cached cookies to impersonate legitimate users and gain unauthorized access to applications.

Technologies: @auth0/nextjs-auth0 (npm). Vendors: Auth0, npm.

Quick answers

Is CVE-2025-48947 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-48947 being exploited in the wild.
How severe is CVE-2025-48947?: Medium severity, with a CVSS score of 4, published 4 June 2025.
Which products and versions are affected?: Auth0 NextJS-Auth0 SDK 4.0.1 to 4.6.0; @auth0/nextjs-auth0 (npm) SEMVER:introduced=4.0.1,fixed=4.6.1.
Is there a fix for CVE-2025-48947?: Yes. @auth0/nextjs-auth0 (npm): upgrade to 4.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-48947 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-48947?: Check whether you run Auth0 NextJS-Auth0 SDK or @auth0/nextjs-auth0 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@auth0/nextjs-auth0 (npm): upgrade to 4.6.1 or later
```
npm install @auth0/nextjs-auth0@4.6.1
```

Technical details

The vulnerability exists in Auth0 NextJS-Auth0 SDK versions 4.0.1 through 4.6.0, where the auth0.middleware fails to set appropriate Cache-Control headers on responses containing __session cookies. This allows intermediate CDN or edge-caching infrastructure to cache the Set-Cookie header, which can then be served to other users. The attack requires the vulnerable SDK version, an application configured with CDN caching, and the attacker's ability to interact with the CDN edge (through passive user interaction). An attacker can obtain valid session cookies from the cache and use them for session hijacking. The vulnerability is fixed in version 4.6.1.

Affected products

Auth0 NextJS-Auth0 SDK 4.0.1 to 4.6.0

Identifiers

CVE-2025-48947
GHSA-f3fg-mf2q-fj3f

Timeline

2025-06-04: disclosed
2025-06-04: patched: Version 4.6.1

References

https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-f3fg-mf2q-fj3f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.