Security Advisory

CVE-2025-46344

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-04-29 20:43:41

Last updated 2025-04-30 13:17:43

Assigner GitHub_M

State PUBLISHED

Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1.

← Browse all CVEs View on cve.org ↗