CVE-2025-48947: Auth0 Next.js SDK Info Disclosure Flaw

CVE-2025-48947 Overview

A session cookie caching vulnerability has been identified in the Auth0 Next.js SDK that could allow sensitive __session cookies to be cached by CDNs due to missing Cache-Control headers. This Information Exposure vulnerability affects applications using the NextJS-Auth0 SDK versions 4.0.1 through 4.6.0 when combined with CDN or edge caching configurations that cache responses containing the Set-Cookie header.

Critical Impact

Attackers could potentially access cached session cookies from CDN edge nodes, leading to session hijacking and unauthorized access to user accounts across affected applications.

Affected Products

• Auth0 Next.js SDK versions 4.0.1 through 4.6.0
• Next.js applications using auth0.middleware with CDN or edge caching
• Applications where Cache-Control headers are not properly set for sensitive responses

Discovery Timeline

• June 4, 2025 - CVE-2025-48947 published to NVD
• June 5, 2025 - Last updated in NVD database

Technical Details for CVE-2025-48947

Vulnerability Analysis

This vulnerability falls under CWE-525 (Use of Web Browser Cache Containing Sensitive Information). The core issue stems from the auth0.middleware component failing to include appropriate Cache-Control headers when setting __session cookies in HTTP responses.

When an application uses the Auth0 Next.js SDK for authentication, the middleware generates session cookies upon successful authentication. Under normal circumstances, these cookies should be treated as sensitive data and explicitly marked as non-cacheable. However, in affected versions, the absence of proper Cache-Control directives means that intermediary caching layers—particularly CDNs and edge servers—may store these responses.

The vulnerability requires three preconditions to be exploitable: the application must use NextJS-Auth0 SDK versions 4.0.1 to 4.6.0, the infrastructure must include CDN or edge caching that caches responses with Set-Cookie headers, and Cache-Control headers must not be properly configured for sensitive authentication responses.

Root Cause

The root cause is the omission of Cache-Control headers in responses generated by auth0.middleware when setting session cookies. The middleware implementation in versions 4.0.1 through 4.6.0 does not programmatically add headers such as Cache-Control: no-store or Cache-Control: private, no-cache to responses that include the __session cookie. This oversight allows caching infrastructure to treat these responses as cacheable content.

Attack Vector

The attack vector operates over the network and requires an attacker to have access to cached responses from a CDN or edge caching layer. The exploitation scenario involves an attacker accessing cached authentication responses that contain valid session cookies. If a user authenticates through the affected application and the response is cached at the CDN level, subsequent requests to the same endpoint could potentially serve the cached response—including the session cookie—to other users or allow an attacker with CDN cache access to retrieve these sensitive tokens.

The attack is considered to have a present attack complexity requirement due to the specific infrastructure conditions that must be met. User interaction is required as a legitimate user must first authenticate to generate the cacheable session response.

Detection Methods for CVE-2025-48947

Indicators of Compromise

• Unexpected session tokens appearing in CDN cache logs or edge server storage
• Multiple users receiving identical session identifiers
• Anomalous authentication patterns showing the same session being used from disparate geographic locations
• CDN access logs showing cached responses for authentication endpoints containing Set-Cookie headers

Detection Strategies

• Audit CDN and edge caching configurations for authentication-related endpoints
• Review HTTP response headers from auth0.middleware endpoints for missing Cache-Control directives
• Implement monitoring for duplicate session cookie values across different user requests
• Scan application dependencies for Auth0 Next.js SDK versions between 4.0.1 and 4.6.0

Monitoring Recommendations

• Enable logging of Cache-Control headers on all authentication-related responses
• Monitor CDN cache hit ratios for authentication endpoints—unexpected cache hits may indicate misconfiguration
• Set up alerts for session anomalies such as geographic impossibility or concurrent usage from multiple IPs
• Regularly audit cached content at CDN edge nodes for sensitive authentication data

How to Mitigate CVE-2025-48947

Immediate Actions Required

• Upgrade @auth0/nextjs-auth0 to version 4.6.1 or later immediately
• Review and invalidate CDN caches that may contain cached session cookies
• Audit existing user sessions and consider forced re-authentication for sensitive applications
• Verify that Cache-Control headers are properly set on all authentication responses

Patch Information

Auth0 has released version 4.6.1 of the Next.js SDK which addresses this vulnerability by ensuring proper Cache-Control headers are included in responses that set session cookies. Users should upgrade by running their package manager's update command. For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Configure CDN or edge caching to exclude responses containing Set-Cookie headers from being cached
• Implement custom middleware to add Cache-Control: no-store, private headers to authentication responses
• Configure cache bypass rules for all authentication-related routes (e.g., /api/auth/*)
• Use CDN cache key configurations that prevent caching of personalized or authenticated content

# Example CDN configuration to prevent caching of Set-Cookie responses
# For Cloudflare Page Rules or similar CDN configurations:
# Path: /api/auth/*
# Cache Level: Bypass
# Edge TTL: 0

# For nginx reverse proxy configuration:
location /api/auth/ {
    add_header Cache-Control "no-store, no-cache, must-revalidate, private" always;
    proxy_pass http://upstream;
}