# CVE-2026-107369: Auth0 nextjs-auth0 open redirect in post-login redirect

Source: https://junglewise.ai/threats/cve-2026-107369-the-auth0-nextjs-auth0-sdk-validates-that-the-returnto-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107369 · Severity: medium · CVSS 6.1 · Published 2026-10-13

The Auth0 Next.js authentication SDK is used to manage user login flows in web applications. An attacker can exploit improper URL validation in the post-login redirect logic to send users to an attacker-controlled domain after they log in, potentially stealing credentials or performing phishing attacks.

Technologies: [Auth0 Nextjs-Auth0](https://junglewise.ai/threats/technologies/nextjs-auth0). Vendors: [Auth0](https://junglewise.ai/threats/vendors/auth0).

## Quick answers

**Is CVE-2026-107369 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107369 being exploited in the wild.

**How severe is CVE-2026-107369?** Medium severity, with a CVSS score of 6.1, published 13 October 2026.

**Which products and versions are affected?** Auth0 Nextjs-Auth0 before 4.32.0.

**Is there a fix for CVE-2026-107369?** Yes: fixed in 4.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107369 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107369?** Check whether you run Auth0 Nextjs-Auth0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.32.0

## Technical details

The SDK validates the returnTo parameter as same-origin but fails to properly reconstruct it when generating the post-authentication redirect URL. The reconstruction logic can produce URLs that browsers interpret as absolute or scheme-relative paths, allowing redirects to unintended domains. This requires user interaction (clicking an authentication link) and results in low confidentiality and integrity impact through phishing or credential theft.

## Affected products

- Auth0 nextjs-auth0 before 4.32.0

## Timeline

- 2026-10-13: disclosed
- 2026-10-13: patched

## References

- [https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-5vvp-h2v6-59j6](https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-5vvp-h2v6-59j6)
- [https://trust.okta.com/security-advisories/improper-validation-of-post-login-redirect-url-in-nextjs-auth0-cve-2026-107369](https://trust.okta.com/security-advisories/improper-validation-of-post-login-redirect-url-in-nextjs-auth0-cve-2026-107369)

## Related threats

- [Auth0 Next.js SDK improper query parameter validation](https://junglewise.ai/threats/cve-2025-67716-auth0-next-js-sdk-improper-query-parameter-validation)
- [Auth0 nextjs-auth0 open redirect in login handler](https://junglewise.ai/threats/cve-2021-43812-auth0-nextjs-auth0-open-redirect-in-login-handler)
- [Auth0 nextjs-auth0 reflected XSS in callback handler](https://junglewise.ai/threats/cve-2021-32702-auth0-nextjs-auth0-reflected-xss-in-callback-handler)