CVE-2025-46344: 
JavaScript vulnerability analysis and mitigation

The Auth0 Next.js SDK vulnerability (CVE-2025-46344) affects versions 4.0.1 through 4.5.0 of the library used for implementing user authentication in Next.js applications. The vulnerability was discovered and disclosed on April 29, 2025, and involves a session token expiration issue where the SDK fails to properly implement session expiration mechanisms (GitHub Advisory, NVD).

The vulnerability stems from the SDK's failure to invoke the .setExpirationTime method when generating a JWE (JSON Web Encryption) token for the session. This implementation flaw results in the JWE token being generated without an internal expiration claim. The vulnerability has been assigned a CVSS v4.0 score of 4.9 (MEDIUM) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U and is classified under CWE-613 (Insufficient Session Expiration) (NVD, Wiz).

The primary impact of this vulnerability is that while the session cookie may expire or be cleared, the JWE token remains perpetually valid. This creates a potential security risk where expired sessions could potentially remain active, bypassing intended session timeout mechanisms (GitHub Advisory).

The vulnerability requires low attack complexity and low privileges to exploit, as indicated by the CVSS score. However, there are no known public exploits at the time of disclosure (Wiz).

The vulnerability has been patched in version 4.5.1 of the Auth0 Next.js SDK. Users are strongly advised to upgrade to this version to address the security issue (GitHub Release).