What’s Vulnerable › Vulnerabilities

CVE-2025-67716: Auth0 Next.js SDK has Improper Validation of Query Parameters

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-11 · updated 2026-10-14
• Weakness: CWE-184

Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.

Affected products

• auth0 nextjs-auth0: from 4.9.0 before 4.12.1 — fixed in 4.12.1

How to fix

Upgrade to a fixed version: auth0 nextjs-auth0 4.12.1. Check the vendor advisory for mitigations.

References

• https://github.com/auth0/nextjs-auth0/commit/35eb321de3345ccf23e8c0d6f66c9f2f2f57d26c
• https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-mr6f-h57v-rpj5

Get alerted when CVE-2025-67716 or the next vulnerability affects your stack