CVE-2025-67490: 
JavaScript vulnerability analysis and mitigation

CVE-2025-67490 is a race condition vulnerability in the Auth0 Next.js SDK (@auth0/nextjs-auth0) that causes improper request caching lookups, potentially leading to incorrect authorization decisions. It affects versions 4.11.0, 4.11.1, and 4.12.0 of the npm package. The vulnerability was discovered by Joshua Rogers (MegaManSec) and disclosed on December 10, 2025, with patches released the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, GHSA).

The root cause is a race condition (CWE-863: Incorrect Authorization) in the TokenRequestCache component introduced in affected SDK versions. When multiple simultaneous requests are made on the same singleton Auth0Client instance, the cache can return results from a different user's in-flight token request, causing the wrong token to be associated with a given request. The fix, applied in commit 26cc8a7, completely removes the TokenRequestCache and the #tokenRequestCache field from Auth0Client, replacing the cached execution path with a direct call to executeGetAccessToken() — eliminating the race condition entirely (GitHub Commit, GitHub Advisory). Exploitation requires the application to use a singleton client instance (the standard recommended pattern), and the attacker must be an authenticated low-privileged user who can trigger concurrent requests.

Successful exploitation can result in an authenticated user receiving another user's access token due to the improper cache lookup, leading to unauthorized access to confidential data (high confidentiality impact) and minor integrity impact from potentially acting on behalf of another user. Availability is not affected. The risk is most significant in multi-tenant or high-concurrency environments where multiple users make simultaneous token requests, as the timing window for the race condition is more likely to be triggered (GitHub Advisory, GHSA).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.048% (15th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires specific timing conditions (high attack complexity), an authenticated low-privileged user, and a high-concurrency environment, making opportunistic exploitation unlikely (GHSA, Feedly).

Upgrade the @auth0/nextjs-auth0 npm package to version 4.11.2 (for the 4.11.x branch) or 4.12.1 (for the 4.12.x branch). No configuration-based workaround is available since the vulnerability is inherent to the TokenRequestCache implementation in affected versions. Applications using a singleton Auth0Client instance — the standard recommended pattern — should treat this as a priority upgrade, especially those handling sensitive user data or operating in multi-tenant, high-concurrency environments (GitHub Advisory, GitHub Commit).

Okta (Auth0's parent company) acknowledged the responsible disclosure by Joshua Rogers (MegaManSec) in the official security advisory. The fix was released on the same day as disclosure, reflecting a coordinated vulnerability disclosure process. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking sources (GitHub Advisory).