CVE-2025-67490

MediumCVSS 5.4

Published: 10/12/2025(UTC)Updated: 25/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The Auth0 Next.js SDK versions 4.11.0 through 4.11.2 and 4.12.0 contain a vulnerability involving improper lookups in the TokenRequestCache during simultaneous requests on the same client. This issue is fixed in versions 4.11.2 and 4.12.1.

Risk Assessment

The risk involves incorrect authentication behavior, which could lead to session errors or unauthorized access in Next.js applications.

Recommendation

It is recommended to immediately update the Auth0 Next.js SDK to version 4.11.2 or 4.12.1 to remediate the vulnerability.

Other vulnerabilities in Auth0 Next.js SDK

CVE-2025-67716Medium
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.

Original NVD description (English source)

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS