PT-2025-50563 · Auth0 · Auth0 Next.Js Sdk

CVE-2025-67716 · Publicado 2025-12-11 · Atualizado 2025-12-11

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Média

Vetor base

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Auth0 Next.js SDK versions 4.9.0 through 4.12.1

Description The Auth0 Next.js SDK has an input-validation issue in the returnTo parameter. This flaw allows attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation could lead to tokens being issued with unintended parameters.

Recommendations Update to version 4.13.0 or later.

Exploit

Correção

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-184

Identificadores relacionados

CVE-2025-67716

GHSA-MR6F-H57V-RPJ5

Produtos afetados

Auth0 Next.Js Sdk

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67716.json · Exploit
• https://github.com/auth0/nextjs-auth0/commit/35eb321de3345ccf23e8c0d6f66c9f2f2f57d26c · Correção
• https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-mr6f-h57v-rpj5 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1999053231838671192 · Publicação no Twitter
• https://t.me/cveNotify/145397 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-67716 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1999108890559201380 · Publicação no Twitter
• https://t.me/CVEtracker/39432 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-67716 · Nota de Segurança