~ / search / GHSA-pjr6-jx7r-j4r6

GHSA-pjr6-jx7r-j4r6

Auth0 NextJS SDK v4 Missing Session Invalidation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-46344

Packages

EcosystemPackageAffectedFixed in
npm @auth0/nextjs-auth0 >= 4.0.1, < 4.5.1 4.5.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Overview Auth0 NextJS `v4.0.1` to `v4.5.0` does not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. ### Am I Affected? You are affected if you are using Auth0 NextJS SDK v4. ### Fix Upgrade to `v4.5.1`.

References

External links from the advisory. They lead to third-party sites.