CVE-2026-107369: Improper Validation of Post-Login Redirect URL in nextjs-auth0
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
auth0/nextjs-auth0to a version that resolves this vulnerability.Fixed in 4.32.0
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely with low attack complexity and requires no privileges. It does require user interaction, meaning a user must follow or interact with an attacker-controlled authentication flow.
Which applications are exposed?
Applications using the npm @auth0/nextjs-auth0 SDK are relevant when they handle a returnTo value for post-login redirects. The issue occurs during reconstruction of a previously validated returnTo value after authentication.
What is the likely security impact?
A successful exploit can redirect a user after authentication to an unintended external domain. The supplied CVSS vector rates confidentiality and integrity impact as low, with no availability impact, and indicates that the impact can extend beyond the vulnerable component's security authority.