CVE-2026-40155
Auth0 Next.js SDK has Improper Proxy Cache Lookup
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Auth0 Next.js SDK has Improper Proxy Cache Lookup
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.
- Record
CVE-2026-40155- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-863, CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2026-23537
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.
- Record
EUVD-2026-23537- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xq8m-7c5p-c2r6
Auth0 Next.js SDK has Improper Proxy Cache Lookup
Description
In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.
Which Projects are Affected?
Users are affected if they meet all of the following preconditions:
- Applications using the auth0/nextjs-auth0 SDK, versions 4.12.0 to 4.17.0, and
- Applications using the proxy handler /me/* and /my-org/* with DPoP enabled.
Affected product and versions
Auth0/nextjs-auth0 v4.12.0 to 4.17.0
Resolution
Upgrade Auth0/nextjs-auth0 version to v4.18.0 or greater
Acknowledgements
Okta would like to thank Reynaldo Immanuel for their discovery and responsible disclosure.
- Record
GHSA-xq8m-7c5p-c2r6- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-362, CWE-863
- Updated
- 2026-11-02
NVD
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.
- Record
CVE-2026-40155- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-362, CWE-863
- Updated
- 2026-11-02
OSV
Auth0 Next.js SDK has Improper Proxy Cache Lookup
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.
- Record
CVE-2026-40155- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-362, CWE-863
- Updated
- 2026-11-02
OSVGHSA-xq8m-7c5p-c2r6
Auth0 Next.js SDK has Improper Proxy Cache Lookup
Description
In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.
Which Projects are Affected?
Users are affected if they meet all of the following preconditions:
- Applications using the auth0/nextjs-auth0 SDK, versions 4.12.0 to 4.17.0, and
- Applications using the proxy handler /me/* and /my-org/* with DPoP enabled.
Affected product and versions
Auth0/nextjs-auth0 v4.12.0 to 4.17.0
Resolution
Upgrade Auth0/nextjs-auth0 version to v4.18.0 or greater
Acknowledgements
Okta would like to thank Reynaldo Immanuel for their discovery and responsible disclosure.
- Record
GHSA-xq8m-7c5p-c2r6- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-362, CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@auth0/nextjs-auth0npm |
4.12.0 to 4.17.0 | 4.18.0 |
@auth0/nextjs-auth0npm |
4.12.0 up to 4.18.0 | 4.18.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40155 is a medium vulnerability (CVSS 5.4) in Auth0 Nextjs-auth0, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in @auth0/nextjs-auth0 4.18.0.
References
github.com/auth0/nextjs-auth0/security/advisories/GHSA-xq8m-7c5p-c2r6
nvd.nist.gov/vuln/detail/CVE-2026-40155