CVE-2025-67490CWE-863broken-access-control

CVE-2025-67490

Medium · published December 11, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
9.6
In the wild
Unconfirmed
What it is

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00202 · 9.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-12-11T04:15Z
Affected products (3)
ProductVersionsFixed in
auth0/nextjs-auth0all versions—
auth0/nextjs-auth0all versions—
auth0/nextjs-auth0all versions—
References (2)
https://github.com/auth0/nextjs-auth0/commit/26cc8a7c60f4b134700912736f991a25bd6bbf0b · [email protected]https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-wcgj-f865-c7j7 · [email protected]
EPSS history
Timeline
  • 10 DEC 22:16Z
    Auth0 Next.js SDK has Improper Request Caching Lookup
    cvelistv5