Auth0 Next.js SDK CVE-2025-67490

Requires the application to use the @auth0/nextjs-auth0 SDK at exactly v4.11.0, 4.11.1, or 4.12.0 configured with a singleton Auth0 client instance, and to receive simultaneous (concurrent) getAccessToken requests on that same client so the TokenRequestCache returns an improper lookup result. Exploitation is limited by the need to win a non-deterministic concurrency race (AC:H), by the attacker needing to be an interacting/authenticated user of the app (PR:L), and by the requirement that another distinct token request be genuinely in-flight at the same moment. It does not affect other SDK versions or non-singleton client patterns.

This is a genuine authorization/confidentiality flaw (CWE-863) but a low real-world priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N = 5.4 Medium) shows the severity is dominated by C:H - cross-request token confusion, where a concurrent request may receive another request's access-token results from the TokenRequestCache. Multiple mitigating signals align: AC:H reflects that exploitation depends on winning a non-deterministic race between simultaneous in-flight token requests on the same singleton client, and PR:L means the actor must already be an interacting user of the application. EPSS is 0.20% (9th percentile), there is no CISA KEV entry, and no public exploit code is referenced - no public exploit identified at time of analysis. The bug is real and vendor-confirmed via GitHub advisory GHSA-wcgj-f865-c7j7 (fix removes the TokenRequestCache entirely), but its exploitation is opportunistic and timing-dependent rather than a reliable, weaponizable attack. Note one inconsistency worth flagging: the input tag 'Authentication Bypass' overstates and mischaracterizes this issue - it is an improper-authorization/race-condition token mix-up (CWE-863), not an auth bypass. Overall: legitimate defect meriting a routine SDK upgrade, not an emergency-patch scenario.

In an app using a singleton Auth0 client, an attacker times authenticated requests to arrive simultaneously with another user's token request so that the shared TokenRequestCache returns the wrong cached in-flight result, potentially handing the attacker an access token minted for a different audience/scope or user context. Because the flaw is a non-deterministic race (AC:H) requiring an already-authenticated session (PR:L), success is opportunistic. No public proof-of-concept is referenced in the available data.