CVE-2025-67716
CVE-2025-67716 · Auth0 Next.js SDK has Improper Validation of Query Parameters
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.
CVSS 5.7 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
nextjs-auth0
- Versions
- >= 4.9.0, < 4.13.0: Affected
No fix published
@auth0/nextjs-auth0 npm
- Affected ranges
- SEMVER: ≥ 4.9.0, < 4.13.0
Update to 4.13.0