Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:08:42 +0000 EUVD-2026-235835 https://cve.radiocsirt.org/vuln/euvd-2026-235835 EUVD-2026-235835 https://cve.radiocsirt.org/vuln/euvd-2026-235835 fkie_cve-2025-46344 https://cve.radiocsirt.org/vuln/fkie_cve-2025-46344 <p>The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1.</p> <p>The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-46344 GHSA-pjr6-jx7r-j4r6 — Auth0 NextJS SDK v4 Missing Session Invalidation https://cve.radiocsirt.org/vuln/ghsa-pjr6-jx7r-j4r6 <p><strong>Affected:</strong> npm: @auth0/nextjs-auth0</p> <p>### Overview Auth0 NextJS `v4.0.1` to `v4.5.0` does not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid.</p> <p>### Am I Affected? You are affected if you are using Auth0 NextJS SDK v4.</p> <p>### Fix Upgrade to `v4.5.1`.</p> <p><strong>Affected:</strong> npm: @auth0/nextjs-auth0</p> <p>### Overview Auth0 NextJS `v4.0.1` to `v4.5.0` does not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid.</p> <p>### Am I Affected? You are affected if you are using Auth0 NextJS SDK v4.</p> <p>### Fix Upgrade to `v4.5.1`.</p> https://cve.radiocsirt.org/vuln/ghsa-pjr6-jx7r-j4r6