PT-2021-23952 · Auth0 · Auth0 Next.Js Sdk

Adamjmcgrath · Published 2021-12-16 · Updated 2021-12-22 · CVE-2021-43812

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Auth0 Next.js SDK versions prior to 1.6.2

Description: The issue is related to the Auth0 Next.js SDK, a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, exposing the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Recommendations: Upgrade to version 1.6.2 or later, as this version contains the necessary fix for the issue. This update will not affect users.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-43812

GHSA-2MQV-4J3R-VJVP

Affected Products

Auth0 Next.Js Sdk

References · 7

• https://github.com/auth0/nextjs-auth0/commit/0bbd9f8a0c93af51f607f28633b5fb18c5e48ad6 · Patch
• https://osv.dev/vulnerability/GHSA-2mqv-4j3r-vjvp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43812 · Security Note
• https://github.com/auth0/nextjs-auth0 · Note
• https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-2mqv-4j3r-vjvp · Note
• https://t.me/cibsecurity/34171 · Telegram Post