Input Validation Flaw in Auth0 Next.js SDK Affects User Authentication Implementation
CVE-2025-67716

5.7MEDIUM

Key Information:

Vendor

Auth0

Status
Nextjs-auth0
Vendor
CVE Published:
11 December 2025

What is CVE-2025-67716?

The Auth0 Next.js SDK has an input-validation flaw in the returnTo parameter that affects versions 4.9.0 through 4.12.1. This vulnerability allows attackers to potentially inject unintended OAuth query parameters into the authorization request. If exploited, this could result in tokens being issued with unexpected parameters, undermining user authentication integrity. The issue is resolved in version 4.13.0, and users are advised to upgrade promptly to mitigate risks.

Affected Version(s)

nextjs-auth0 >= 4.9.0, < 4.13.0

References

https://github.com/auth0/nextjs-auth0/security/advisories...
x_refsource_CONFIRM
https://github.com/auth0/nextjs-auth0/commit/35eb321de334...
x_refsource_MISC

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-67716 : Input Validation Flaw in Auth0 Next.js SDK Affects User Authentication Implementation