Reflected XSS from the callback handler's error query parameter

Description

Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message.

Recommendation

Update the @auth0/nextjs-auth0 package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.4.2
• Patched version(s): 1.4.2

References

• GHSA-954c-jjx6-cxv7
• www.npmjs.com
• CVE-2021-32702
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server crashes with query parameter - CVE-2021-39187
• Reflected XSS when using flashMessages or languageDictionary - CVE-2021-32641
• QooxDoo XSS in Callback Parameter - CVE-2011-1714
• Clipboard-based XSS - CVE-2021-41086

Tags:

npm

@auth0/nextjs-auth0