CVE-2025-67490

Executive Summary

CVE-2025-67490 is a race condition vulnerability in the Auth0 Next.js SDK, affecting versions 4.11.0 through 4.11.2 and 4.12.0. The flaw resides in the TokenRequestCache mechanism, where simultaneous requests from the same client can lead to improper lookups, potentially causing authentication tokens to be mismatched or reused. This could allow an attacker to hijack a session or gain unauthorized access to user accounts. The vulnerability has a CVSS score of 5.4 (Medium) and a low EPSS score of 0.0%, indicating limited exploitation in the wild. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects the @auth0/nextjs-auth0 npm package. Organizations using this package should immediately update to versions 4.11.2 or 4.12.1. The package is widely used in Next.js applications for authentication, making this a supply chain risk. Ensure that your package-lock.json or yarn.lock is updated and that CI/CD pipelines are configured to block vulnerable versions.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The vulnerability is exploitable remotely without authentication, but the impact is limited to potential token leakage or session confusion. The low EPSS score suggests that exploitation is not currently widespread.

Deep Dive & Mechanics

The Auth0 Next.js SDK uses a TokenRequestCache to store and retrieve authentication tokens during the OAuth flow. When a user initiates a login, the SDK caches the token request to avoid redundant calls. However, due to a race condition, if multiple requests are made simultaneously from the same client (e.g., via concurrent browser tabs or rapid page loads), the cache may return a token intended for a different request. This can lead to:

• Session Hijacking: An attacker could intercept a token meant for another user.
• Authentication Bypass: A user might be authenticated with another user's credentials.
• Token Reuse: Tokens may be reused across sessions, violating security policies.

The root cause is improper synchronization in the cache lookup logic. The fix involves adding proper locking mechanisms to ensure that each request retrieves its own token.

Vulnerable vs. Patched Code

Vulnerable Code (4.11.0 - 4.11.2, 4.12.0):

// TokenRequestCache.js (simplified)
class TokenRequestCache {
  constructor() {
    this.cache = new Map();
  }

  async getOrCreate(key, createFn) {
    if (this.cache.has(key)) {
      return this.cache.get(key);
    }
    const promise = createFn();
    this.cache.set(key, promise);
    return promise;
  }
}

Patched Code (4.11.2, 4.12.1):

// TokenRequestCache.js (simplified)
class TokenRequestCache {
  constructor() {
    this.cache = new Map();
    this.locks = new Map();
  }

  async getOrCreate(key, createFn) {
    if (this.cache.has(key)) {
      return this.cache.get(key);
    }
    // Acquire a lock for this key
    if (!this.locks.has(key)) {
      this.locks.set(key, Promise.resolve());
    }
    const lock = this.locks.get(key);
    await lock;
    // Double-check after lock
    if (this.cache.has(key)) {
      return this.cache.get(key);
    }
    const promise = createFn();
    this.cache.set(key, promise);
    return promise;
  }
}

The patch introduces a locking mechanism to prevent concurrent access to the same cache key.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Next.js application using @auth0/nextjs-auth0 version 4.11.0 to 4.11.2 or 4.12.0.
• Ability to send multiple simultaneous requests from the same client (e.g., using a script or browser automation).

Exploitation Steps:

1. Identify the target application's login endpoint.
2. Use a tool like curl or a Python script to send multiple concurrent login requests from the same IP/session.
3. Monitor the responses for token mismatches or session confusion.
4. If successful, capture tokens from one request and use them to impersonate another user.

Example Script (Python):

import asyncio
import aiohttp

async def send_login(session, url):
    async with session.get(url) as resp:
        return await resp.text()

async def exploit():
    url = "https://target.com/api/auth/login"
    async with aiohttp.ClientSession() as session:
        tasks = [send_login(session, url) for _ in range(10)]
        results = await asyncio.gather(*tasks)
        # Analyze results for token reuse
        print(results)

asyncio.run(exploit())

Blue Team

Detection:

• Monitor for multiple rapid authentication requests from the same IP address.
• Look for anomalies in token issuance, such as the same token being used for different sessions.
• Use the detection rules provided below.

Mitigation:

• Immediately update to patched versions (4.11.2 or 4.12.1).
• Implement rate limiting on authentication endpoints.
• Add logging for token cache hits and misses.

Indicators of Compromise (IOCs)

• Network: Multiple concurrent HTTP requests to /api/auth/login or similar endpoints from the same source IP.
• Application Logs: Entries showing TokenRequestCache hits for the same key within a short time window.
• Token Patterns: JWT tokens with identical jti (JWT ID) claims across different sessions.

Detection Engineering

YARA Rule

rule Detect_Auth0_TokenCache_RaceCondition {
    meta:
        description = "Detects vulnerable Auth0 Next.js SDK versions in source code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67490"
    strings:
        $vuln_version1 = "@auth0/nextjs-auth0@4.11.0"
        $vuln_version2 = "@auth0/nextjs-auth0@4.11.1"
        $vuln_version3 = "@auth0/nextjs-auth0@4.12.0"
        $cache_class = "TokenRequestCache"
        $vuln_pattern = "this.cache.set(key, promise)"
    condition:
        any of ($vuln_version*) and $cache_class and $vuln_pattern
}

Sigma Rule

title: Detection of Auth0 Token Cache Race Condition Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects multiple rapid authentication requests from the same source IP
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-67490
logsource:
    category: web
    product: nextjs
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/auth/login'
        c-ip: '*'
    condition: selection | count() by c-ip > 5 within 1 second
falsepositives:
    - Legitimate rapid page loads
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-67490 Auth0 Token Cache Race Condition"; flow:to_server; content:"GET"; http_method; content:"/api/auth/login"; http_uri; threshold:type both, track by_src, count 5, seconds 1; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update the @auth0/nextjs-auth0 package to version 4.11.2 or 4.12.1.

   npm install @auth0/nextjs-auth0@4.11.2
   # or
   npm install @auth0/nextjs-auth0@4.12.1
   

2. Verify Update: Check your package.json and package-lock.json for the correct version.
3. Rate Limiting: Implement rate limiting on authentication endpoints to reduce the risk of race condition exploitation.
4. Monitoring: Enable detailed logging for authentication flows and monitor for anomalies.
5. Security Review: Conduct a code review of any custom authentication logic that may be affected.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.