What is the CVSS score of CVE-2025-48947?

CVE-2025-48947 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. EPSS exploitation probability: 0.1%.

Which versions of Next.js are affected by CVE-2025-48947?

Auth0 Next.js SDK versions 4.0.1-4.6.0 may expose user session cookies through CDN caching, potentially allowing attackers to hijack authenticated user sessions.. A patch is available.

How to fix or mitigate CVE-2025-48947?

Within 24 hours: Identify all applications using Auth0 Next.js SDK versions 4.0.1-4.6.0 and inventory CDN/edge caching configurations. Within 7 days: Upgrade to auth0/nextjs-auth0 v4.6.1 or implement compensating controls on all affected applications. Within 30 days: Complete full deployment of patched versions across all environments and validate Cache-Control headers are properly set on authentication responses.

Next.js CVE-2025-48947

EUVD-2025-16914 HIGH

Use of Web Browser Cache Containing Sensitive Information (CWE-525)

2025-06-04 security-advisories@github.com

GHSA-f3fg-mf2q-fj3f

Next.js Node.js Information Disclosure Authentication Bypass

7.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16914

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

CVE Published

Jun 04, 2025 - 21:15 nvd

HIGH 7.7

DescriptionGitHub Advisory

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, __session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for someone to be affected by the vulnerability: Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, applications using CDN or edge caching that caches responses with the Set-Cookie header, and if the Cache-Control header is not properly set for sensitive responses. Users should upgrade auth0/nextjs-auth0 to v4.6.1 to receive a patch.