Executive brief
Auth0's Next.js SDK is a library used by developers to integrate authentication and identity services into Node.js/Next.js web applications. An input validation flaw in the SDK's handling of redirect URLs could allow attackers to inject malicious OAuth parameters, potentially resulting in tokens being issued with unintended scopes or claims that grant unauthorized access. Exploitation requires attacker-controlled input and user interaction with a malicious link.
Technical details
The vulnerability is an incomplete input validation flaw (CWE-184) in the returnTo parameter of the Auth0 Next.js SDK. The SDK fails to properly sanitize the returnTo parameter before using it in the OAuth authorization request, allowing attackers to inject arbitrary query parameters into the authorization flow. This is a parameter pollution attack with network reachability and user interaction requirements; a victim must click a crafted link containing malicious returnTo values. Successful exploitation allows parameter injection that can result in tokens being issued with unintended OAuth parameters. The vulnerability affects versions 4.9.0 through 4.12.x, with a fix available in version 4.13.0.
Affected products
- Auth0 nextjs-auth0 4.9.0 to 4.12.x
Timeline
- 2025-12-10: disclosed
- 2025-12-10: patched: version 4.13.0 released