CVE-2025-46344

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/auth0/nextjs-auth0/commit/a4f061aed02ffa132feca8adfbd11704df17e1c3
https://github.com/auth0/nextjs-auth0/releases/tag/v4.5.1
https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-pjr6-jx7r-j4r6

Configurations

No configuration.

History

02 May 2025, 13:53

Type	Values Removed	Values Added
Summary		(es) El SDK Auth0 Next.js es una librería para implementar la autenticación de usuarios en aplicaciones Next.js. Las versiones a partir de la 4.0.1 y anteriores a la 4.5.1 no invocan `.setExpirationTime` al generar un token JWE para la sesión. Por lo tanto, el JWE no contiene una notificación de expiración interna. Aunque la cookie de sesión pueda expirar o borrarse, el JWE sigue siendo válido. Este problema se ha corregido en la versión 4.5.1.

29 Apr 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-29 21:15

Updated : 2025-05-02 13:53

NVD link : CVE-2025-46344

Mitre link : CVE-2025-46344

CVE.ORG link : CVE-2025-46344

JSON object : View

Products Affected

No product.

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-46344", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-29T21:15:51.987", "references": [{"url": "https://github.com/auth0/nextjs-auth0/commit/a4f061aed02ffa132feca8adfbd11704df17e1c3", "source": "security-advisories@github.com"}, {"url": "https://github.com/auth0/nextjs-auth0/releases/tag/v4.5.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-pjr6-jx7r-j4r6", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1."}, {"lang": "es", "value": "El SDK Auth0 Next.js es una librer\u00eda para implementar la autenticaci\u00f3n de usuarios en aplicaciones Next.js. Las versiones a partir de la 4.0.1 y anteriores a la 4.5.1 no invocan `.setExpirationTime` al generar un token JWE para la sesi\u00f3n. Por lo tanto, el JWE no contiene una notificaci\u00f3n de expiraci\u00f3n interna. Aunque la cookie de sesi\u00f3n pueda expirar o borrarse, el JWE sigue siendo v\u00e1lido. Este problema se ha corregido en la versi\u00f3n 4.5.1."}], "lastModified": "2025-05-02T13:53:40.163", "sourceIdentifier": "security-advisories@github.com"}

JSON object

Attach tags to CVE-2025-46344

Attach tags to `CVE-2025-46344`