GHSA-pjr6-jx7r-j4r6
First published: Tue Apr 29 2025(Updated: )
### Overview Auth0 NextJS `v4.0.1` to `v4.5.0` does not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. ### Am I Affected? You are affected if you are using Auth0 NextJS SDK v4. ### Fix Upgrade to `v4.5.1`.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/@auth0/nextjs-auth0 | >=4.0.1<4.5.1 | 4.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-pjr6-jx7r-j4r6
- https://github.com/auth0/nextjs-auth0/commit/a4f061aed02ffa132feca8adfbd11704df17e1c3
- https://github.com/auth0/nextjs-auth0/releases/tag/v4.5.1
- https://nvd.nist.gov/vuln/detail/CVE-2025-46344
- https://github.com/advisories/GHSA-pjr6-jx7r-j4r6 (Advisory)
Frequently Asked Questions
What is the vulnerability GHSA-pjr6-jx7r-j4r6?
GHSA-pjr6-jx7r-j4r6 is a vulnerability in Auth0 NextJS versions 4.0.1 to 4.5.0 where the JWE token does not have an expiration claim due to the failure to invoke .setExpirationTime.
What is the severity of GHSA-pjr6-jx7r-j4r6?
The severity of GHSA-pjr6-jx7r-j4r6 is classified as a security flaw that can lead to potential session hijacking.
How do I fix GHSA-pjr6-jx7r-j4r6?
To fix GHSA-pjr6-jx7r-j4r6, upgrade the @auth0/nextjs-auth0 package to version 4.5.1 or later.
Which versions of @auth0/nextjs-auth0 are affected by GHSA-pjr6-jx7r-j4r6?
Versions 4.0.1 to 4.5.0 of @auth0/nextjs-auth0 are affected by GHSA-pjr6-jx7r-j4r6.
Can I continue using the affected versions of @auth0/nextjs-auth0 after GHSA-pjr6-jx7r-j4r6 is disclosed?
It is not recommended to continue using the affected versions of @auth0/nextjs-auth0 without applying the necessary updates due to security risks.
- agent/weakness
- agent/last-modified-date
- agent/source
- agent/references
- agent/softwarecombine
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-pjr6-jx7r-j4r6
- alias/CVE-2025-46344
- agent/software-canonical-lookup
- package-manager/npm