PT-2025-50563 · Auth0 · Auth0 Next.Js Sdk

Published 2025-12-11 · Updated 2025-12-11 · CVE-2025-67716

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Auth0 Next.js SDK versions 4.9.0 through 4.12.1

Description The Auth0 Next.js SDK has an input-validation issue in the returnTo parameter. This flaw allows attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation could lead to tokens being issued with unintended parameters.

Recommendations Update to version 4.13.0 or later.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2025-67716

GHSA-MR6F-H57V-RPJ5

Affected Products

Auth0 Next.Js Sdk

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67716.json · Exploit
• https://github.com/auth0/nextjs-auth0/commit/35eb321de3345ccf23e8c0d6f66c9f2f2f57d26c · Patch
• https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-mr6f-h57v-rpj5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67716 · Security Note
• https://twitter.com/VulmonFeeds/status/1999053231838671192 · Twitter Post
• https://t.me/cveNotify/145397 · Telegram Post
• https://twitter.com/CVEnew/status/1999108890559201380 · Twitter Post
• https://t.me/CVEtracker/39432 · Telegram Post