Description In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.

Which Projects are Affected? Users are affected if they meet all of the following preconditions: - Applications using the auth0/nextjs-auth0 SDK, versions 4.12.0 to 4.17.0, and - Applications using the proxy handler /me/ and /my-org/ with DPoP enabled.

Affected product and versions Auth0/nextjs-auth0 v4.12.0 to 4.17.0

Resolution Upgrade Auth0/nextjs-auth0 version to v4.18.0 or greater

Acknowledgements Okta would like to thank Reynaldo Immanuel for their discovery and responsible disclosure.

Description An input-validation flaw in the returnTo parameter in the Auth0 Next.js SDK could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters

Am I Affected? You are affected if you meet the following preconditions: - Applications using the auth0/nextjs-auth0 SDK version prior to 4.13.0

Affected product and versions Auth0/nextjs-auth0 versions >= 4.9.0 and < 4.13.0

Resolution Upgrade Auth0/nextjs-auth0 version to v4.13.0

Acknowledgements Okta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.

Description When using affected versions of the Next.js SDK, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results.

Am I Affected? You are affected if you meet the following preconditions: - Applications using the auth0/nextjs-auth0 SDK with a singleton client instance, versions 4.11.0, 4.11.1, and 4.12.0.

Affected product and versions Auth0/nextjs-auth0 v4.11.0, v4.11.1, and v4.12.0.

Resolution Upgrade Auth0/nextjs-auth0 version to v4.11.2 or v4.12.1

Acknowledgements Okta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.