Medium severity5.4NVD Advisory· Published Apr 17, 2026· Updated Apr 27, 2026
CVE-2026-40155
CVE-2026-40155
Description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@auth0/nextjs-auth0npm | >= 4.12.0, < 4.18.0 | 4.18.0 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/auth0/nextjs-auth0/commit/98c36dc306970c2230ea1a32efef431d29b99978nvdPatchWEB
- github.com/advisories/GHSA-xq8m-7c5p-c2r6ghsaADVISORY
- github.com/auth0/nextjs-auth0/security/advisories/GHSA-xq8m-7c5p-c2r6nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-40155ghsaADVISORY
- github.com/auth0/nextjs-auth0/releases/tag/v4.18.0nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.