Auth0 Next.js SDK CVE-2025-67716

Exploitation requires that the application's returnTo value (used by withPageAuthRequired / the login redirect in @auth0/nextjs-auth0 4.9.0-4.12.1) carry attacker-influenced content that is then passed unencoded into the Auth0 authorization URL; per the patch, vulnerable code built '?returnTo=${returnTo}' without encodeURIComponent, so any ampersand/equals characters in returnTo are interpreted as additional OAuth query parameters. Limiting factors are significant: the attack is network-reachable but needs a privileged/authenticated context and victim user interaction (clicking a crafted login/redirect link), it only applies to apps on the affected version range, and real impact depends on whether returnTo is derived from untrusted input rather than static developer-supplied strings. It does NOT affect apps already on 4.13.0 or later.

This is a moderate-risk, low-urgency issue that should be patched on a normal cadence rather than treated as an emergency. The multi-source signals are consistent and point AWAY from widespread danger: EPSS is 0.26% (17th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The input CVSS of 5.7 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) is itself a mixed signal: it pairs high confidentiality/integrity impact with three strong barriers - high attack complexity (AC:H), high privileges (PR:H), and required user interaction (UI:R). Per CVSS the vector is network-reachable but requires authenticated privilege (PR:H) and victim interaction, so this is NOT a drive-by unauthenticated RCE despite AV:N. One tension worth noting: the C:H/I:H impact in the supplied vector appears generous for the described outcome ('tokens being issued with unintended parameters' via OAuth query-parameter injection), which is typically a scope/audience-manipulation issue rather than full data compromise - this is why my independent assessment lowers the impact metrics. The vulnerability is real and the GitHub/Okta advisory plus a vendor patch confirm it, but the combination of low EPSS, no KEV, no POC, and meaningful exploitation preconditions makes this a 'patch in due course' item, not a fire drill.

An attacker crafts a login or redirect link whose returnTo value smuggles extra OAuth query parameters (for example an altered scope or audience) because the SDK fails to URL-encode returnTo before building the Auth0 authorization request. A victim with an authenticated context follows the crafted flow, and the injected parameters are appended to the authorization request, potentially causing Auth0 to issue tokens with unintended scope or audience. No public exploit code was identified, and the CVSS AC:H/PR:H/UI:R metrics mean the attack requires favorable preconditions and user interaction rather than a trivial remote hit.