Is CVE-2025-67716 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-67716 being exploited in the wild.

How severe is CVE-2025-67716?

Medium severity, with a CVSS score of 5.7, published 11 December 2025.

Which products and versions are affected?

Auth0 Nextjs-Auth0 4.9.0 to 4.12.x; @auth0/nextjs-auth0 (npm) SEMVER:introduced=4.9.0,fixed=4.13.0.

Is there a fix for CVE-2025-67716?

Yes. @auth0/nextjs-auth0 (npm): upgrade to 4.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-67716 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-67716?

Check whether you run Auth0 Nextjs-Auth0 or @auth0/nextjs-auth0 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67716: Auth0 Next.js SDK improper query parameter validation

CVE-2025-67716 · Severity: medium · CVSS 5.7 · Published 2025-12-11

Auth0's Next.js SDK is a library used by developers to integrate authentication and identity services into Node.js/Next.js web applications. An input validation flaw in the SDK's handling of redirect URLs could allow attackers to inject malicious OAuth parameters, potentially resulting in tokens being issued with unintended scopes or claims that grant unauthorized access. Exploitation requires attacker-controlled input and user interaction with a malicious link.

Technologies: Auth0 Nextjs-Auth0, @auth0/nextjs-auth0 (npm). Vendors: Auth0, npm.

Quick answers

Is CVE-2025-67716 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-67716 being exploited in the wild.
How severe is CVE-2025-67716?: Medium severity, with a CVSS score of 5.7, published 11 December 2025.
Which products and versions are affected?: Auth0 Nextjs-Auth0 4.9.0 to 4.12.x; @auth0/nextjs-auth0 (npm) SEMVER:introduced=4.9.0,fixed=4.13.0.
Is there a fix for CVE-2025-67716?: Yes. @auth0/nextjs-auth0 (npm): upgrade to 4.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-67716 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-67716?: Check whether you run Auth0 Nextjs-Auth0 or @auth0/nextjs-auth0 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@auth0/nextjs-auth0 (npm): upgrade to 4.13.0 or later
```
npm install @auth0/nextjs-auth0@4.13.0
```

Technical details

The vulnerability is an incomplete input validation flaw (CWE-184) in the returnTo parameter of the Auth0 Next.js SDK. The SDK fails to properly sanitize the returnTo parameter before using it in the OAuth authorization request, allowing attackers to inject arbitrary query parameters into the authorization flow. This is a parameter pollution attack with network reachability and user interaction requirements; a victim must click a crafted link containing malicious returnTo values. Successful exploitation allows parameter injection that can result in tokens being issued with unintended OAuth parameters. The vulnerability affects versions 4.9.0 through 4.12.x, with a fix available in version 4.13.0.

Affected products

Auth0 nextjs-auth0 4.9.0 to 4.12.x

Identifiers

CVE-2025-67716
GHSA-mr6f-h57v-rpj5

Timeline

2025-12-10: disclosed
2025-12-10: patched: version 4.13.0 released

References

https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-mr6f-h57v-rpj5

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.