CVE-2026-40155

OVERVIEW CVE-2026-40155 affects the Auth0 Next.js SDK versions 4.12.0 through 4.17.1. The vulnerability exists in the proxy cache fetcher logic, where simultaneous requests triggering nonce retries can cause improper token request lookups. Exploitation requires specific configuration: applications must use both vulnerable SDK versions and the proxy handler routes /me/* and /my-org/* with Demonstration of Proof-of-Concept (DPoP) enabled. The issue was remediated in version 4.18.0. SEVERITY The vulnerability carries a CVSS 3.1 score of 5.4 (MEDIUM severity) with a network attack vector requiring both low privilege and user interaction, resulting in high confidentiality impact and limited integrity impact. The EPSS score of 0.00041 indicates this threat is ranked lower than 99.8% of all known CVEs, suggesting minimal real-world exploitation probability at this time. EXPLOITATION STATUS No active exploitation has been reported; the vulnerability does not appear on the KEV catalog and is classified as inactive on the Hot List. Community attention remains limited, consistent with the low EPSS score. No widespread exploit code availability has been documented. Organizations should prioritize patching based on their use of the affected SDK versions and specific proxy handler configurations rather than immediate threat response.