CVE-2025-67490

Katalog CVE

CVSS 5.4 · Medium EPSS 0,20%

Kerentanan Incorrect Authorization pada nextjs-auth0. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

Rincian

Terbit di NVD

10 Desember 2025

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-wcgj-f865-c7j7 advisory vendor
• https://github.com/auth0/nextjs-auth0/commit/26cc8a7c60f4b134700912736f991a25bd6bbf0b patch