nextjs-auth0 vulnerabilities
CVEs whose affected-version data names the nextjs-auth0 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-107369Medium· 6.1The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL …
CVE-2025-67716Medium· 5.7The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended O…
CVE-2025-67490Medium· 5.4The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRe…