CVE-2021-43812CWE-601

Open redirect in nextjs-auth0

Medium · published December 16, 2021

CVSS v3.1
6.4
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00677 · 51.7th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2021-12-16T18:20Z
EPSS history
Timeline
  • 16 DEC 18:20Z
    Open redirect in nextjs-auth0
    cvelistv5