Open redirect in @auth0/nextjs-auth0

Description

Versions <=1.6.1 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability.

Recommendation

Update the @auth0/nextjs-auth0 package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.6.2
• Patched version(s): 1.6.2

References

• GHSA-2mqv-4j3r-vjvp
• CVE-2021-43812
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• PrismJS DOM Clobbering vulnerability - CVE-2024-53382
• Auth0 NextJS SDK v4 Missing Session Invalidation - CVE-2025-46344
• qs vulnerable to Prototype Pollution - CVE-2022-24999
• Server-Side Request Forgery in axios - CVE-2024-39338

Tags:

npm

@auth0/nextjs-auth0