Vulnerability · Published Dec 16, 2021 · Assigned by GitHub_M
CVE-2021-43812Open redirect in nextjs-auth0
Medium 6.4
In plain English
A medium-severity open redirect in nextjs-auth0 from auth0. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @auth0/nextjs-auth0 | 1.6.2 | GHSA-2mqv-4j3r-vjvp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| auth0 | nextjs-auth0 | < 1.6.2 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N