CVE-2026-40155CWE-362CWE-863

Auth0 Next.js SDK has Improper Proxy Cache Lookup

Medium · published April 17, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-863 · Incorrect Authorization
Published
2026-04-17T20:54Z
EPSS history
Timeline
  • 17 APR 20:54Z
    Auth0 Next.js SDK has Improper Proxy Cache Lookup
    cvelistv5