VYPR
← All advisories
Medium severity5.7NVD Advisory· Published Dec 11, 2025· Updated Jun 17, 2026

CVE-2025-67716

CVE-2025-67716

Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@auth0/nextjs-auth0npm
>= 4.9.0, < 4.13.04.13.0

Affected products

3
  • Auth0/Nextjs Auth02 versions
    cpe:2.3:a:auth0:nextjs-auth0:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:auth0:nextjs-auth0:*:*:*:*:*:node.js:*:*range: >=4.9.0,<4.12.1
    • (no CPE)range: >= 4.9.0, < 4.13.0
  • ghsa-coords
    pkg:npm/%40auth0/nextjs-auth0
    Range: >= 4.9.0, < 4.13.0

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.