Auth0 Next.js SDK JWE Token Expiration Vulnerability

A vulnerability exists in the Auth0 Next.js SDK, specifically in versions 4.0.1 through 4.5.0. The issue arises because the SDK does not call '.setExpirationTime' when creating a JWE token for the session. Consequently, the JWE lacks an internal expiration claim. While the session cookie may expire or be deleted, the JWE remains valid, potentially allowing for unauthorized session persistence.

Impact

Exploitation of this vulnerability allows for JWE tokens to remain valid even after associated session cookies have expired or been cleared, leading to unauthorized access.

Reproduction

To reproduce this vulnerability, use Auth0 Next.js SDK version 4.0.1 to 4.5.0. Create a session that generates a JWE token. After the session cookie expires or is cleared, the JWE token can still be used, demonstrating that the token was not properly invalidated.

Remediation

Upgrade to Auth0 Next.js SDK version 4.5.1 or later.