OktaOKTA-1LZONCB
CDN Caching of Session Cookies in NextJS-Auth0 SDK CVE-2025-48947 - Jun 3, 2025
UnratedCVE-2025-48947 · Published Jun 3, 2025
In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, __session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Upgrade auth0/nextjs-auth0 to version 4.6.1.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
More Okta advisories
All Okta| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 222025 | Okta On-Premises Provisioning (OPP) Password Reset Information Disclosure CVE-2025-7371... | Unrated | No fix yet |
| Jun 32025 | Deserialization of Untrusted Data in Auth0-PHP SDK CVE-2025-48951 - Jun 3, 2025 | Unrated | No fix yet |
| May 152025 | Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2025-47275... | Unrated | No fix yet |
| May 62025 | SAML Attribute Smuggling Vulnerability Allowing User Impersonation in Passport-WS-Fed... | Unrated | No fix yet |
| May 62025 | SAML Signature Wrapping Vulnerability Leading to User Impersonation in Passport-WS-Fed... | Unrated | No fix yet |
| Apr 302025 | JWT Invalid Signature Validation in Auth0 Account Linking Extensions CVE-2025-46345 - Apr... | Unrated | No fix yet |