Nextjs Auth0
Monthly
Authentication bypass in Auth0 Next.js SDK versions 4.12.0 through 4.17.1 allows authenticated users with UI interaction to access sensitive endpoints through improper proxy cache lookups during concurrent nonce retry operations. The vulnerability specifically affects deployments using the proxy handler with DPoP (Demonstration of Proof-of-Possession) enabled, potentially exposing confidential user information via /me/* and /my-org/* endpoints. Vendor-released patch: version 4.18.0.
OAuth query-parameter injection in the Auth0 Next.js SDK (@auth0/nextjs-auth0) versions 4.9.0 through 4.12.1 lets an attacker who can influence the returnTo value append unintended key/value pairs to the Auth0 authorization request, so the resulting login redirect may carry injected parameters such as scope, audience, or connection and issue tokens with unintended properties. Confirmed exploited status is not established - no public exploit code has been identified at time of analysis and the issue is not in CISA KEV - and EPSS is low at 0.26% (17th percentile), with real-world impact gated on an authenticated/privileged context, victim interaction with a crafted login link, and the application actually deriving returnTo from untrusted input rather than a static developer-supplied string. Auth0/Okta fixed the flaw in version 4.13.0, which URL-encodes returnTo via encodeURIComponent before it is placed in the redirect; our independent assessment rates this moderate risk and low urgency, suitable for routine patch cadence rather than emergency response.
Concurrent token requests handled by the Auth0 Next.js SDK can be resolved through an internal in-flight request cache to the wrong result, causing an application that uses a singleton Auth0 client to receive an access token belonging to a different, simultaneously executed request - an incorrect-authorization and confidentiality exposure tracked as CWE-863. Only @auth0/nextjs-auth0 versions 4.11.0, 4.11.1, and 4.12.0 are affected; releases 4.11.2 and 4.12.1 remove the faulty TokenRequestCache. Exploitation is gated on winning a non-deterministic concurrency race (AC:H) by an authenticated user of the application (PR:L), the EPSS score is only 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Authentication bypass in Auth0 Next.js SDK versions 4.12.0 through 4.17.1 allows authenticated users with UI interaction to access sensitive endpoints through improper proxy cache lookups during concurrent nonce retry operations. The vulnerability specifically affects deployments using the proxy handler with DPoP (Demonstration of Proof-of-Possession) enabled, potentially exposing confidential user information via /me/* and /my-org/* endpoints. Vendor-released patch: version 4.18.0.
OAuth query-parameter injection in the Auth0 Next.js SDK (@auth0/nextjs-auth0) versions 4.9.0 through 4.12.1 lets an attacker who can influence the returnTo value append unintended key/value pairs to the Auth0 authorization request, so the resulting login redirect may carry injected parameters such as scope, audience, or connection and issue tokens with unintended properties. Confirmed exploited status is not established - no public exploit code has been identified at time of analysis and the issue is not in CISA KEV - and EPSS is low at 0.26% (17th percentile), with real-world impact gated on an authenticated/privileged context, victim interaction with a crafted login link, and the application actually deriving returnTo from untrusted input rather than a static developer-supplied string. Auth0/Okta fixed the flaw in version 4.13.0, which URL-encodes returnTo via encodeURIComponent before it is placed in the redirect; our independent assessment rates this moderate risk and low urgency, suitable for routine patch cadence rather than emergency response.
Concurrent token requests handled by the Auth0 Next.js SDK can be resolved through an internal in-flight request cache to the wrong result, causing an application that uses a singleton Auth0 client to receive an access token belonging to a different, simultaneously executed request - an incorrect-authorization and confidentiality exposure tracked as CWE-863. Only @auth0/nextjs-auth0 versions 4.11.0, 4.11.1, and 4.12.0 are affected; releases 4.11.2 and 4.12.1 remove the faulty TokenRequestCache. Exploitation is gated on winning a non-deterministic concurrency race (AC:H) by an authenticated user of the application (PR:L), the EPSS score is only 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.