Nextjs Auth0 EUVD-2026-23537

Exploitation requires four specific conditions: (1) Application uses Auth0 Next.js SDK versions 4.12.0 through 4.17.1; (2) The proxy handler is configured and in use for /me/* and /my-org/* endpoints; (3) DPoP (Demonstration of Proof-of-Possession) is explicitly enabled in Auth0 configuration; (4) The attacker must be authenticated with an active session and able to trigger concurrent requests (either by user interaction or JavaScript execution in their session context). The attacker must also successfully time their request to collide with another user's nonce retry operation, which requires either statistically likely collision in high-concurrency scenarios or deliberate timing control. No special network positioning or privileges beyond basic authenticated user status are required. Exploitation is prevented if DPoP is disabled, the proxy handler is not in use, or the application is on version 4.18.0 or later.

CVSS 5.4 with AV:N/AC:H/PR:L/UI:R indicates network-accessible but moderate-complexity exploitation requiring authenticated access and user interaction (e.g., user clicking a malicious link or automated redirect during active session). The AC:H (high complexity) factor reflects that successful exploitation requires precise timing of concurrent requests and triggering a nonce retry condition, reducing likelihood of accidental or opportunistic exploitation. EPSS and KEV status are not provided in input data, limiting real-world probability assessment beyond CVSS scoring. The authentication bypass tag combined with PR:L and the high confidentiality impact (C:H) suggests an authenticated attacker can escalate access to peer user data on shared endpoints. However, the requirement for UI:R (user interaction) and AC:H (timing/concurrency complexity) means this is not a trivial network attack - it requires either social engineering or positioning during an active session. The impact is confined to information disclosure (C:H) with minimal integrity risk (I:L) and no availability impact, indicating data exfiltration rather than system compromise. This is a legitimate security issue affecting production deployments but not an immediate critical threat compared to unauthenticated RCE vectors. Risk is proportional to deployment scale: organizations with many concurrent users are at higher statistical risk of accidental collision.

An authenticated attacker with an active session monitors the application for nonce retry patterns. When another user initiates a concurrent request to the /me endpoint (typically a user profile fetch), the attacker triggers their own request to the same endpoint with precise timing to collide with the nonce retry, causing the proxy cache fetcher to misattribute the victim's cached token response to the attacker's request. The attacker gains access to the victim's sensitive profile data, organization membership, or other endpoint-specific information without explicit permission. This scenario is more likely in high-concurrency environments (many simultaneous users) or where the attacker can influence timing via browser automation or session manipulation.