VulnSocial

CVE-2026-40155General(auth0 / nextjs-auth0)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.

auth0 CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-362CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • nextjs-auth0

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-04-18); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
auth0
Products
nextjs-auth0

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-18: 1Mentions · 2026-04-28: 1Technical Details · 2026-04-28: 104-1804-28
Signal classification2 categories
General
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-04-181
General1
2026-04-281
Disclosure1
Full discourse2 posts
  • cvereports@_cvereports
    Disclosure

    CVE-2026-40155: CVE-2026-40155: Race Condition in Auth0 Next.js SDK DPoP Proxy Fetcher A race condition vulnerability in the Auth0 Next.js SDK (versions 4.12.0 through 4.17.1) leads to improper proxy cache lookups during Demonstrating Proof-of-Possess... https://cvereports.com/reports/CVE-2026-40155

    Post summary

    A newly disclosed race condition in Auth0 Next.js SDK causes improper proxy cache lookups; the report details the vulnerability but offers no PoC, exploit, or patch information.

    0000038
    36 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-40155 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger… https://www.cve.org/CVERecord?id=CVE-2026-40155

    Post summary

    A concise reference to CVE-2026-40155 affecting Auth0 Next.js SDK, but lacking detailed technical, exploit, or mitigation information.

    00000181
    57.2K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appauth0nextjs-auth0-node.js-

Explore more

Back to dashboardauth0 CVEsnextjs-auth0 vulnerabilities