CVE-2025-67490
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Dec 10, 2025
CISA due date
—
The record
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @auth0/nextjs-auth0 | 4.11.0 | 4.11.2 |
| npm | @auth0/nextjs-auth0 | 4.12.0 | 4.12.1 |
Related vulnerabilities
- GHSA-wcgj-f865-c7j7 Improper Request Caching Lookup in the Auth0 Next.js SDK Same vulnerability
- GHSA-xq8m-7c5p-c2r6 Auth0 Next.js SDK has Improper Proxy Cache Lookup Also affects @auth0/nextjs-auth0
- CVE-2026-40155 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js… Also affects @auth0/nextjs-auth0
- CVE-2025-67716 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js… Also affects @auth0/nextjs-auth0
- GHSA-mr6f-h57v-rpj5 Improper Validation of Query Parameters in Auth0 Next.js SDK Also affects @auth0/nextjs-auth0
- CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful… CWE-863
- CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request… CWE-863