Auth0 Next.js SDK Improper Proxy Cache Lookup Vulnerability Allowing DPoP Nonce Retry Issues

A vulnerability exists in the Auth0 Next.js SDK, specifically in versions 4.12.0 through 4.17.1. This issue arises when simultaneous requests trigger a nonce retry, leading the proxy cache fetcher to conduct incorrect token request result lookups. Projects using the vulnerable SDK versions along with the proxy handler paths '/me/*' and '/my-org/*' with DPoP enabled are affected.

Impact

Exploitation of this vulnerability can disrupt the proper functioning of DPoP nonce management, potentially leading to incorrect token handling and session updates.

Reproduction

To reproduce this vulnerability, first, ensure that the Auth0 Next.js SDK version is between 4.12.0 and 4.17.1. Then, enable DPoP and use the proxy handler paths '/me/*' or '/my-org/*'. Initiate simultaneous requests that trigger a nonce retry. This will cause the proxy cache fetcher to perform improper lookups for the token request results, demonstrating the vulnerability.

Remediation

Upgrade the Auth0 Next.js SDK to version 4.18.0 or later.