Improper Validation of Post-Login Redirect URL in nextjs-auth0 CVE-2026-107369 - Oct 13, 2026
Description
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain.
Preconditions
A user initiates an authentication flow using a link configured with a custom returnTo parameter, and
After pathname decomposition and reconstruction, the resulting returnTo value is processed by the browser as an absolute or scheme-relative URL.
Affected product and versions
Customers using auth0/nextjs-auth0 versions prior to version 4.32.0 are affected.
Customer Recommendations
To remediate this vulnerability, upgrade auth0/nextjs-auth0 to version 4.32.0 or greater.
Resolution
The vulnerability is present in auth0/nextjs-auth0 versions prior to version 4.32.0 and is resolved in version 4.32.0.
CVE details
CVE ID | |
Published Date | 2026-10-13 |
Vulnerability Type | Open Redirect |
CWE | CWE-601 – URL Redirection to Untrusted Site ('Open Redirect') |
CVSS v3 | Score: 6.1 Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
References
Improper Validation of Post-Login Redirect URL in nextjs-auth0