Open redirect in @auth0/nextjs-auth0

Description

Versions <=1.6.1 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability.

Recommendation

Update the @auth0/nextjs-auth0 package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.6.2
• Patched version(s): 1.6.2

References

• GHSA-2mqv-4j3r-vjvp
• CVE-2021-43812
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Oils JS vulnerable to Open Redirect - CVE-2021-4260
• Open redirect in url-parse (GHSA-hh27-ffr2-f2jc) - CVE-2021-3664
• Auth0 NextJS SDK v4 Missing Session Invalidation - CVE-2025-46344
• Open redirect in karma - CVE-2021-23495

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@auth0/nextjs-auth0