All vulnerabilities
CVE-2026-107369GHSA-5vvp-h2v6-59j6

Improper Validation of Post-Login Redirect URL in nextjs-auth0

Auth0 nextjs-auth0
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.32.0Fixed versionCVE List
Published13 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

  • 4.32.0nextjs-auth0CVE List
  • 4.32.0@auth0/nextjs-auth0, npmGitHubnpm install @auth0/nextjs-auth0@4.32.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain.

Text from CVE List

Affected versions 2

  • nextjs-auth0affected: all versions before 4.32.0CVE List
  • @auth0/nextjs-auth0, npm< 4.32.0GitHub

References 2