TI-2021-19618 Aliases CVE-2021-43812 GHSA-2mqv-4j3r-vjvp

Open redirect in nextjs-auth0

LOW 30CWE-601Published 2021-12-16 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Why it matters now

EPSS 0.00677 52nd percentileScored 2026-11-07

Fix Fixed nextjs-auth0 (auth0): 1.6.2@auth0/nextjs-auth0 (npm): 1.6.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
auth0	nextjs-auth0	before 1.6.2	1.6.2	Patch available	CNA
—	@auth0/nextjs-auth0 (npm)	before 1.6.2	1.6.2	Patch available	GHSA-2mqv-4j3r-vjvp

nextjs-auth0 Vendorauth0 Affected before 1.6.2 Fixed in 1.6.2 Patch available CNA
@auth0/nextjs-auth0 (npm) Vendor— Affected before 1.6.2 Fixed in 1.6.2 Patch available GHSA-2mqv-4j3r-vjvp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:auth0:nextjs-auth0::::::node.js::*	before 1.6.2	Vulnerable	auth0

cpe:2.3:a:auth0:nextjs-auth0:*:*:*:*:*:node.js:*:* Versions before 1.6.2 Vulnerable ·auth0

Remediation

Fix · CNA nextjs-auth0 (auth0) Fixed in 1.6.2
Fix · GHSA-2mqv-4j3r-vjvp @auth0/nextjs-auth0 (npm) Fixed in 1.6.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-43812
2026-10-03 Alias added: GHSA-2mqv-4j3r-vjvp
2026-10-09 EPSS moved to the 50th–90th percentile

References

Patch 1

https://github.com/auth0/nextjs-auth0/commit/0bbd9f8a0c93af51f607f28633b5fb18c5e48ad6

Advisory 2

Other 1

https://github.com/auth0/nextjs-auth0

TI-2021-12370 Reflected XSS from the callback handler's error query parameter CVSS 3.1HIGH 8.0
TI-2025-41412 Auth0 Next.js SDK has Improper Validation of Query Parameters CVSS 3.1MEDIUM 5.7
TI-2026-28970 Auth0 Next.js SDK has Improper Proxy Cache Lookup CVSS 3.1MEDIUM 5.4
TI-2025-41249 Auth0 Next.js SDK has Improper Request Caching Lookup CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences