CVE-2025-67716Medium· 5.7▾ SunlitThe Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended O…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.
nextjs-auth0 >= 4.9.0, < 4.12.1Upgrade past the affected range:
nextjs-auth0 4.12.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107369Medium· 6.1The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL
CVE-2025-67490Medium· 5.4The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications
CVE-2026-85473Medium· 5.3The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value
CVE-2026-107371Medium· 5.4When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value
CVE-2026-107370Medium· 5.3When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request
CVE-2025-68129Medium· 6.8Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs