IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-04-29 21:15

MODIFIED

2025-05-02 13:53

EPSS (Prob. Exploit)

0.44%

Top 61.7%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-08

> DESCRIPTION

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-pjr6-jx7r-j4r6 MODERATE

Auth0 NextJS SDK v4 Missing Session Invalidation

AFFECTED PACKAGES:

NPM / @auth0/nextjs-auth0

>= 4.0.1, < 4.5.1

Fixed in: 4.5.1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Auth0 NextJS SDK v4 Missing Session Invalidation

AFFECTED PACKAGES:

Unknown / Unknown

ALIASES:

GHSA-pjr6-jx7r-j4r6

> HISTORIQUE DES MODIFICATIONS

Première apparition

29/04/2025 21:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:03

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui