CVE-2025-46344 Auth0 NextJS SDK v4 Missing Session Invalidation
Attackers can maintain persistent access because session tokens lack internal expiration claims, allowing continued use after cookie expiry.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46344?
CVE-2025-46344 is a medium-severity vulnerability in nextjs-auth0, published on 29 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1.
Weakness: CWE-613
Which versions are affected by CVE-2025-46344?
2 open source packages ship an affected version, including @auth0/nextjs-auth0.
| Package | Affected | Fixed in |
|---|---|---|
@auth0/nextjs-auth0 npm | From 4.0.1 | 4.5.1 |
@auth0/nextjs-auth0 npm | From 4.0.1 | 4.5.1 |
How do I fix CVE-2025-46344?
Upgrade @auth0/nextjs-auth0 to 4.5.1 or later.
Is CVE-2025-46344 being exploited?
There is no known exploitation of CVE-2025-46344 in the wild and no public exploit code.
Sources
Also known as GHSA-pjr6-jx7r-j4r6.