Description

When using affected versions of the Next.js SDK, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results.

Affected versions

You are affected if you meet the following preconditions:

• Applications using the auth0/nextjs-auth0 SDK with a singleton client instance, versions 4.11.0, 4.11.1, and 4.12.0.

Resolution

Upgrade Auth0/nextjs-auth0 version to 4.11.2 or 4.12.1

Acknowledgements

Okta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.

CVE details

References

Improper Request Caching Lookup in the Auth0 Next.js SDK