Auth0 NextJS SDK v4 Missing Session Invalidation

中 4.9CVE-2025-46344 · GHSA-pjr6-jx7r-j4r6 · 29/04/2025 公開 · 17/06/2026 更新

要点

CVE-2025-46344 は @auth0/nextjs-auth0 に影響する深刻度「中」 (CVSS 4.9) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.44%（全脆弱性の 38.1% より高い）。
対処：4.5.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
@auth0/nextjs-auth0 npm	`≥ 4.0.1, < 4.5.1`	`4.5.1`

概要

Overview

Auth0 NextJS v4.0.1 to v4.5.0 does not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid.

Am I Affected?

You are affected if you are using Auth0 NextJS SDK v4.

Fix

Upgrade to v4.5.1.

NVD の説明

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1.