CVE-2021-32702: Reflected XSS from the callback handler's error query parameter
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using @auth0/nextjs-auth0 version 1.4.1 or lower unless you are using custom error handling that does not return the error message in an HTML response. Upgrade to version 1.4.1 to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32702?
CVE-2021-32702 has a high severity rating due to its potential for reflected XSS attacks that allows arbitrary code execution.
How do I fix CVE-2021-32702?
To fix CVE-2021-32702, upgrade the Auth0 Next.js SDK to version 1.4.2 or later.
What types of applications are affected by CVE-2021-32702?
CVE-2021-32702 affects Next.js applications that utilize the Auth0 Next.js SDK versions 1.4.1 and earlier.
Can CVE-2021-32702 lead to data breaches?
Yes, CVE-2021-32702 can lead to data breaches by allowing attackers to execute arbitrary code and potentially access sensitive information.
Is CVE-2021-32702 related to user authentication vulnerabilities?
Yes, CVE-2021-32702 is specifically related to user authentication vulnerabilities in the Auth0 Next.js SDK.