nextjs-auth0 SDK EUVD-2026-100481

Exploitation requires that the application use auth0/nextjs-auth0 prior to version 4.32.0 and that an attacker can induce a user to follow a crafted authentication link containing a malicious returnTo parameter - the value must pass the SDK's same-origin check yet be reconstructed into a URL browsers treat as absolute or scheme-relative. The key limiting factor is UI:R: a victim must actively click the attacker-supplied link and complete authentication, so there is no silent or self-propagating exploitation. No special non-default server configuration is required beyond using an affected SDK version in the standard login-redirect flow; impact is limited to redirection (no direct code execution or data read on the host).

This is a moderate-severity open redirect (CWE-601) in the auth0/nextjs-auth0 SDK, rated CVSS 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The signals are internally consistent and point to a real but bounded risk rather than a critical priority: network vector and low complexity make it easy to trigger, PR:N confirms no authentication is needed, but UI:R means a victim must actually click a crafted link, which caps its real-world severity. The scope change (S:C) and low confidentiality/integrity impact reflect that the attacker's gain is indirect - the SDK redirects the browser to an attacker-controlled domain rather than directly compromising the application. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The practical danger is phishing/credential-harvesting and potential OAuth token or authorization-code interception during the post-authentication redirect flow - meaningful for an authentication SDK but dependent on social engineering. Overall this is a legitimate fix-worthy flaw (patched in 4.32.0) but not an emergency; prioritize patching on normal cadence rather than as a drop-everything incident.

An attacker crafts a login link to a legitimate site using the auth0/nextjs-auth0 SDK, embedding a returnTo value that passes same-origin validation but is reconstructed by the SDK into a scheme-relative or absolute URL. The victim authenticates normally, and after login the SDK redirects their browser to an attacker-controlled domain - enabling a convincing phishing page or interception of post-authentication flow artifacts. No public exploit code is identified at time of analysis, but the flaw is low-complexity to reproduce given the public advisory.