Medium severity · published Apr 17, 2026
CVE-2026-40155
Auth0 Next.js SDK has Improper Proxy Cache Lookup
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
nextjs-auth0 · auth0
>= 4.12.0, < 4.18.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40155
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40155
Patch
https://github.com/auth0/nextjs-auth0/commit/98c36dc306970c2230ea1a32efef431d29b99978
Product
https://github.com/auth0/nextjs-auth0/releases/tag/v4.18.0
Vendor Advisory
https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-xq8m-7c5p-c2r6
More from nextjs-auth0
7.7
CVE-2025-48947
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
6.1
CVE-2026-107369
Improper Validation of Post-Login Redirect URL in nextjs-auth0
6.1
CVE-2021-43812
Open redirect in nextjs-auth0
6.1
CVE-2021-32702
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications
5.7
CVE-2025-67716
Auth0 Next.js SDK has Improper Validation of Query Parameters