auth0 nextjs-auth0 up to 4.6.0 Header Cache-Control web browser cache containing sensitive information

Summaryinfo

A vulnerability labeled as critical has been found in auth0 nextjs-auth0 up to 4.6.0. This issue affects some unknown processing of the component Header Handler. Such manipulation of the argument Cache-Control leads to use of web browser cache containing sensitive information. This vulnerability is documented as CVE-2025-48947. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in auth0 nextjs-auth0 up to 4.6.0 and classified as critical. Affected by this issue is an unknown part of the component Header Handler. The manipulation of the argument Cache-Control with an unknown input leads to a use of web browser cache containing sensitive information vulnerability. Using CWE to declare the problem leads to CWE-525. The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for someone to be affected by the vulnerability: Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if the Cache-Control header is not properly set for sensitive responses. Users should upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-48947 since 05/28/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 4.6.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-16914). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• auth0

Name

• nextjs-auth0

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6.0

Website

• Product: https://github.com/auth0/nextjs-auth0/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion