CVE Feed

    Dashboard / CVE / CVE-2026-40155

    CVE-2026-40155

    The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.

    Published:Apr 17, 2026
    Last Modified:Apr 27, 2026
    EPS:Apr 17, 2026
    EPSS Score:0.00041
    CVSS Score:5.4

    Affected Products

    Vendor
    Auth0
    Product
    Nextjs-auth0

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-67716 (CVSS 5.7) — The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.…
    CVE-2025-67490 (CVSS 5.4) — The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using ve…
    CVE-2025-48947 (CVSS 7.7) — The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next…
    CVE-2025-46344 (CVSS 4.9) — The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions star…
    CVE-2021-43812 (CVSS 6.4) — The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions befo…
    CVE-2021-32702 (CVSS 8) — The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions befo…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High