{"action":"Upgrade @auth0/nextjs-auth0 to 4.5.1 or later.","affected":[{"fixed":"4.5.1","introduced":"4.0.1"}],"component":"@auth0/nextjs-auth0","cve_ids":["CVE-2025-46344"],"ecosystem":"npm","epss":0.00438,"exploited":false,"fixed_versions":["4.5.1"],"ghsa_id":"GHSA-pjr6-jx7r-j4r6","id":"tcs_01M5KG3W2FHX7HBCYWB32NCH7G","modified_at":"2025-04-30T17:25:56Z","published_at":"2025-04-29T18:54:49Z","references":["https://osv.dev/vulnerability/GHSA-pjr6-jx7r-j4r6","https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-pjr6-jx7r-j4r6","https://nvd.nist.gov/vuln/detail/CVE-2025-46344","https://github.com/auth0/nextjs-auth0/commit/a4f061aed02ffa132feca8adfbd11704df17e1c3","https://github.com/auth0/nextjs-auth0","https://github.com/auth0/nextjs-auth0/releases/tag/v4.5.1"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-pjr6-jx7r-j4r6","url":"https://osv.dev/vulnerability/GHSA-pjr6-jx7r-j4r6"},{"source":"nvd","source_id":"CVE-2025-46344","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46344"}],"summary":"Auth0 NextJS SDK v4 Missing Session Invalidation"}