Auth0 Next.js SDK CDN Caching Vulnerability Allowing Session Cookie Exposure

A vulnerability exists in Auth0 Next.js SDK versions 4.0.1 through 4.6.0, where `__session` cookies set by auth0.middleware may be cached by CDNs. This issue arises from the absence of Cache-Control headers, allowing sensitive cookies to be stored in cached responses. To be affected, applications must use a vulnerable version of the Next.js Auth0 SDK, employ CDN or edge caching that stores responses with the Set-Cookie header, and fail to properly configure the Cache-Control header for sensitive responses.

Impact

Exploitation of this vulnerability can lead to unauthorized access to session cookies, potentially allowing for session hijacking or impersonation of users.

Remediation

Users should upgrade to Auth0 Next.js SDK version 4.6.1, which addresses this vulnerability.