7.7

CVE-2025-48947: auth0 nextjs-auth0

CVSS: 7.7v4.0HighDeferred
AliasesGHSA-f3fg-mf2q-fj3f
Published 04-06-2025Last modified 04-06-2025
Open JSON

Vulnerability summary

CVE-2025-48947 is a high (CVSS 7.7) vulnerability in auth0 nextjs-auth0. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.2% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 04-06-2025
    PublishedVulnerability first disclosed.
  2. 04-06-2025
    Last modifiedVulnerability information updated.

Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for someone to be affected by the vulnerability: Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if the Cache-Control header is not properly set for sensitive responses. Users should upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

0.00 pp

From 0.43% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

@auth01 product
  • nextjs-auth0≥ 4.0.1, < 4.6.1
Auth01 product

2 vendors · 2 products

References

4 links