Open redirect in @auth0/nextjs-auth0

Description

Versions <=1.6.1 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability.

Recommendation

Update the @auth0/nextjs-auth0 package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.6.2
• Patched version(s): 1.6.2

References

• GHSA-2mqv-4j3r-vjvp
• CVE-2021-43812
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies - CVE-2025-48947
• Auth0 NextJS SDK v4 Missing Session Invalidation - CVE-2025-46344
• Open redirect in karma - CVE-2021-23495
• Oils JS vulnerable to Open Redirect - CVE-2021-4260

Tags:

npm

@auth0/nextjs-auth0