CVE-2025-48947

Executive Summary

CVE-2025-48947 is a medium-severity vulnerability in the Auth0 Next.js SDK (versions 4.0.1 through 4.6.0) that allows CDN caching of sensitive session cookies. The root cause is the absence of Cache-Control: no-store headers on responses that set the __session cookie. When a CDN or edge cache caches a response containing a Set-Cookie header, subsequent users may receive a cached response with another user's session cookie, leading to session hijacking and unauthorized access.

The vulnerability requires three preconditions: (1) use of the affected SDK versions, (2) a CDN or edge cache that caches Set-Cookie responses, and (3) missing Cache-Control headers on sensitive responses. The patch (v4.6.1) adds explicit Cache-Control: no-store headers to prevent caching.

Supply Chain & Package Security

This vulnerability affects the auth0/nextjs-auth0 npm package. Organizations using this package in their Next.js applications should verify their dependency version and update to v4.6.1 or later. The package is widely used for authentication in Next.js applications, making this a supply chain risk for any application relying on Auth0 for user authentication.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated 7.5 (High) based on vector
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Threat Level: High – Exploitation can lead to session hijacking and account takeover without user interaction.

Deep Dive & Mechanics

The vulnerability lies in the middleware component of the Auth0 Next.js SDK. When a user authenticates, the middleware sets a __session cookie in the HTTP response. However, the response does not include a Cache-Control: no-store header. CDNs and edge caches that respect Set-Cookie headers may cache this response. When another user requests the same resource, the CDN may serve the cached response, including the original user's __session cookie. This allows the second user to impersonate the first user.

The attack flow:

1. User A authenticates via the Auth0 Next.js SDK.
2. The middleware sets Set-Cookie: __session=<session_token> in the response.
3. The CDN caches this response (including the Set-Cookie header).
4. User B requests the same resource.
5. The CDN serves the cached response to User B, including User A's session cookie.
6. User B's browser sets the cookie, granting them access as User A.

Vulnerable vs. Patched Code

Vulnerable Code (v4.0.1 - v4.6.0):

// middleware.js (simplified)
export default async function middleware(req, res) {
  // ... authentication logic ...
  res.setHeader('Set-Cookie', `__session=${sessionToken}; HttpOnly; Secure; SameSite=Lax`);
  // Missing: Cache-Control header
  return res;
}

Patched Code (v4.6.1):

// middleware.js (simplified)
export default async function middleware(req, res) {
  // ... authentication logic ...
  res.setHeader('Set-Cookie', `__session=${sessionToken}; HttpOnly; Secure; SameSite=Lax`);
  res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
  res.setHeader('Pragma', 'no-cache');
  res.setHeader('Expires', '0');
  return res;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Next.js application using Auth0 Next.js SDK v4.0.1 - v4.6.0.
• A CDN or edge cache that caches responses with Set-Cookie headers (e.g., Cloudflare, Akamai, Varnish).
• The application must not set Cache-Control: no-store on authentication responses.

Exploitation Steps:

1. Identify the target application and confirm it uses the vulnerable SDK version.
2. Trigger authentication as User A (e.g., via login).
3. Observe the response headers: Set-Cookie: __session=<token> and no Cache-Control: no-store.
4. Wait for the CDN to cache the response (may require multiple requests).
5. As User B, request the same resource (e.g., /api/auth/callback).
6. If the CDN serves the cached response, User B's browser will set User A's session cookie.
7. User B can now access User A's account.

Proof-of-Concept (PoC) Script:

import requests

target_url = "https://target-app.com/api/auth/callback?code=..."
# Step 1: Authenticate as User A
session_a = requests.Session()
response_a = session_a.get(target_url)
print("User A cookies:", session_a.cookies.get_dict())

# Step 2: As User B, request the same URL (assuming CDN caching)
session_b = requests.Session()
response_b = session_b.get(target_url)
print("User B cookies:", session_b.cookies.get_dict())

# If User B received User A's session cookie, exploitation is successful
if '__session' in session_b.cookies:
    print("Session hijacking successful!")

Blue Team

Detection:

• Monitor for multiple users receiving the same __session cookie value.
• Alert on responses containing Set-Cookie: __session without Cache-Control: no-store.
• Use WAF rules to block responses that set cookies without proper cache control.

Prevention:

• Immediately upgrade to auth0/nextjs-auth0 v4.6.1.
• Configure CDN to not cache responses with Set-Cookie headers.
• Add explicit Cache-Control: no-store headers to all authentication-related responses.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP responses with Set-Cookie: __session=<value> and no Cache-Control: no-store header.
  • Multiple users receiving identical __session cookie values.
  • CDN cache hits on authentication endpoints (e.g., /api/auth/callback).

• File IOCs:

  • package.json containing "@auth0/nextjs-auth0": "4.0.1" through "4.6.0".
  • Middleware code missing Cache-Control header.

• Behavioral IOCs:

  • Unexplained session sharing between users.
  • Users accessing resources without proper authentication.

Detection Engineering

YARA Rule

rule CVE_2025_48947_Auth0_Session_Cache {
    meta:
        description = "Detects vulnerable Auth0 Next.js SDK versions in package.json"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48947"
        severity = "high"
    strings:
        $package_name = "@auth0/nextjs-auth0"
        $version_range = /"version":\s*"(4\.[0-5]\.\d|4\.6\.0)"/
    condition:
        $package_name and $version_range
}

Sigma Rule

title: CVE-2025-48947 - Auth0 Next.js Session Cookie Caching
id: 8f3a2b1c-5d6e-7f8a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects HTTP responses with Set-Cookie for __session without Cache-Control: no-store
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        response_headers|contains: 'Set-Cookie: __session='
    filter:
        response_headers|contains: 'Cache-Control: no-store'
    condition: selection and not filter
falsepositives:
    - Legitimate responses with proper cache control
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48947 - Auth0 Next.js Session Cookie Caching"; flow:to_client; content:"Set-Cookie: __session="; http_server_body; nocase; pcre:"/Cache-Control:\s*no-store/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade @auth0/nextjs-auth0 to version 4.6.1 or later.
2. Verify that all authentication responses include Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate.
3. Configure CDN/edge cache to not cache responses with Set-Cookie headers.

Long-term Mitigations:

• Implement Content Security Policy (CSP) headers.
• Use short-lived session tokens with rotation.
• Monitor for anomalous session usage patterns.
• Conduct regular security audits of third-party dependencies.

Workaround (if patching is not immediately possible):

• Add custom middleware to set Cache-Control: no-store on all responses that set the __session cookie.
• Disable CDN caching for authentication endpoints.

Valters IT