Homepage

@auth0/nextjs-auth0@4.31.1

Auth0 Next.js SDK

  • latest version

    4.32.1

  • latest non vulnerable version

    4.32.1

  • first published

    7 years ago

  • latest version published

    1 days ago

  • licenses detected

  • View nextjs-auth0 package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @auth0/nextjs-auth0 package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Open Redirect

    @auth0/nextjs-auth0 is a Next.js SDK for signing in with Auth0

    Affected versions of this package are vulnerable to Open Redirect via the returnTo parameter, where the SDK validates it as a same-origin URL but the subsequent reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path. An attacker can craft a link that initiates an authentication flow with a malicious returnTo value, causing the post-authentication redirect to send the user to an unintended external domain.

    Note: This is only exploitable when a user initiates an authentication flow using a link configured with a custom returnTo parameter.

    How to fix Open Redirect?

    Upgrade @auth0/nextjs-auth0 to version 4.32.0 or higher.

    <4.32.0
    Go back to all versions of this package