---
id: CVE-2025-67490
title: >-
  The Auth0 Next.js SDK is a library for implementing user authentication in
  Next.js applications
summary: >-
  The Auth0 Next.js SDK is a library for implementing user authentication in
  Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0,
  simultaneous requests on the same client may result in improper lookups in the
  TokenRe…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N'
cwe:
  - CWE-863
vendor: auth0
product: nextjs-auth0
affected:
  - nextjs-auth0 = 4.11.0
  - nextjs-auth0 = 4.11.1
  - nextjs-auth0 = 4.12.0
published: '2025-12-10'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T23:10:00.463'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67490'
references:
  - url: >-
      https://github.com/auth0/nextjs-auth0/commit/26cc8a7c60f4b134700912736f991a25bd6bbf0b
    label: security-advisories@github.com
  - url: >-
      https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-wcgj-f865-c7j7
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00202
epssPercentile: 0.08982
ingestedAt: '2026-09-25T23:21:16.943Z'
---

## Overview

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

## Affected

- `nextjs-auth0 = 4.11.0`
- `nextjs-auth0 = 4.11.1`
- `nextjs-auth0 = 4.12.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.