CVE-2026-40155: 
JavaScript vulnerability analysis and mitigation

CVE-2026-40155 is a race condition vulnerability in the Auth0 Next.js SDK (@auth0/nextjs-auth0) that causes improper proxy cache lookups for token request results. Affecting versions 4.12.0 through 4.17.1, the flaw is triggered when simultaneous requests initiate a nonce retry in the proxy cache fetcher, potentially exposing authentication tokens intended for other users. It was discovered by Reynaldo Immanuel and disclosed on April 17, 2026, with a fix released the same day. The vulnerability carries a CVSS v3.1 base score of 5.4 (Moderate/High) (Github Advisory, Feedly).

The root cause is a race condition (CWE-362) combined with incorrect authorization (CWE-863) in the SDK's proxy cache fetcher. In the vulnerable implementation, the AuthClient and AuthClientProvider cached entire Fetcher instances (including their getAccessToken callbacks) per audience key. When concurrent requests triggered a DPoP nonce retry, the shared cached fetcher's getAccessToken could be overwritten mid-flight, causing one user's token resolution to be returned to a different user's request. The fix (commit 98c36dc) replaced fetcher-level caching with caching only the DPoPHandle object (proxyDpopHandles), ensuring each request gets a fresh, session-scoped fetcher while still sharing nonce state across requests for the same audience. Exploitation requires the application to use the proxy handlers /me/* or /my-org/* with DPoP enabled (Github Advisory, Patch Commit).

Successful exploitation can result in high confidentiality impact — specifically, an authenticated user may receive access tokens or authentication data belonging to another user via the miscached proxy fetcher response. There is also a low integrity impact, as the incorrect token association could allow limited unauthorized actions on behalf of another user. Availability is not affected. The scope is limited to applications using the vulnerable SDK versions with DPoP-enabled proxy handlers, but the exposure of OAuth tokens could enable session hijacking or unauthorized API access within the affected application (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.023% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires low privileges, user interaction, and high attack complexity — specifically, the ability to time concurrent requests to trigger a nonce retry race condition in a DPoP-enabled deployment (Github Advisory, Feedly).

1. Identify a vulnerable target: Locate a Next.js application using @auth0/nextjs-auth0 versions 4.12.0–4.17.1 with DPoP enabled and proxy handlers for /me/* or /my-org/* exposed.
2. Obtain low-privilege authentication: Authenticate to the target application with a valid but low-privileged account to obtain a session.
3. Trigger concurrent nonce retry requests: Send multiple simultaneous HTTP requests to the /me/* or /my-org/* proxy endpoints in rapid succession, timed to coincide with a DPoP nonce retry event (e.g., when the server returns a use_dpop_nonce error and the SDK retries with a new nonce).
4. Race the cache fetcher: The concurrent requests race to update the shared cached Fetcher instance's getAccessToken callback. If the timing window is hit, one request's token resolution overwrites another's in the shared fetcher.
5. Receive another user's token: The attacker's request receives a token response intended for a concurrent user's session, granting unauthorized access to that user's resources via the proxy (Github Advisory, Patch Commit).

• Logs: Unexpected access token usage patterns where a single token appears associated with multiple user sessions or user IDs in application logs; Auth0 audit logs showing token issuance anomalies for /me or /my-org proxy endpoints.
• Network: Bursts of near-simultaneous requests to /me/* or /my-org/* proxy endpoints from the same or different authenticated sessions, particularly during DPoP nonce retry sequences.
• Application Behavior: Users reporting receiving data or resources belonging to other users; authorization errors or unexpected data in API responses from the proxy handler endpoints.

The primary remediation is to upgrade @auth0/nextjs-auth0 to version 4.18.0 or later, which fixes the race condition by caching only the DPoPHandle rather than the entire fetcher instance (Github Advisory, Release v4.18.0). If immediate patching is not possible, consider disabling DPoP functionality or restricting access to the /me/* and /my-org/* proxy handlers as a temporary workaround. No configuration-only fix is available that fully mitigates the race condition without upgrading.

Okta (Auth0's parent company) acknowledged the responsible disclosure by researcher Reynaldo Immanuel in the official security advisory. The fix was released on the same day as disclosure (April 17, 2026), indicating a coordinated disclosure process. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking (Github Advisory).