CVE-2025-67716: Auth0 Next.js SDK has Improper Validation of Query Parameters
Description An input-validation flaw in the returnTo parameter in the Auth0 Next.js SDK could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters
Am I Affected? You are affected if you meet the following preconditions: - Applications using the auth0/nextjs-auth0 SDK version prior to 4.13.0
Affected product and versions Auth0/nextjs-auth0 versions >= 4.9.0 and < 4.13.0
Resolution Upgrade Auth0/nextjs-auth0 version to v4.13.0
Acknowledgements Okta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.
Other sources
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67716?
CVE-2025-67716 has a moderate severity level due to its potential to allow OAuth query parameter injection.
How do I fix CVE-2025-67716?
To fix CVE-2025-67716, update the @auth0/nextjs-auth0 package to version 4.13.0 or later.
Who is affected by CVE-2025-67716?
Users of the @auth0/nextjs-auth0 package versions between 4.9.0 and 4.13.0 are affected by CVE-2025-67716.
What impact does CVE-2025-67716 have on my application?
The impact of CVE-2025-67716 includes the risk of issuing tokens with unintended OAuth query parameters, potentially compromising security.
Is there a workaround for CVE-2025-67716?
There is no official workaround for CVE-2025-67716; upgrading to the latest version is the recommended solution.