What is CVE-2025-48947?

**Overview** In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, __session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. **Am I Affected?** You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, 2. Applications using CDN or edge caching that caches responses with the Set-Cookie header. 3. If the Cache-Control header is not properly set for sensitive responses. **Fix** Upgrade auth0/nextjs-auth0 to v4.6.1.

What is the severity of CVE-2025-48947?

CVE-2025-48947 has a CVSS v3 score of 0, which is classified as Low severity.

Is there an exploit available for CVE-2025-48947?

No known public exploits are currently available for CVE-2025-48947.

Is there a patch available for CVE-2025-48947?

Yes, patches are available for CVE-2025-48947. Check the vendor advisories for update instructions.

CVE-2025-48947 - CVE Details, Severity, and Analysis

Overview In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, __session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0,
Applications using CDN or edge caching that caches responses with the Set-Cookie header.
If the Cache-Control header is not properly set for sensitive responses.

Fix Upgrade auth0/nextjs-auth0 to v4.6.1.