{"id":"CVE-2025-67716","sourceIdentifier":"security-advisories@github.com","published":"2025-12-11T01:16:00.890","lastModified":"2026-10-14T20:10:00.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0."},{"lang":"es","value":"El SDK de Auth0 para Next.js es una biblioteca para implementar la autenticación de usuarios en aplicaciones Next.js. Las versiones 4.9.0 a la 4.12.1 contienen una falla de validación de entrada en el parámetro returnTo, lo que podría permitir a los atacantes inyectar parámetros de consulta OAuth no deseados en la solicitud de autorización de Auth0. La explotación exitosa puede resultar en la emisión de tokens con parámetros no deseados. Este problema está corregido en la versión 4.13.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"auth0","product":"nextjs-auth0","versions":[{"version":">= 4.9.0, < 4.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.5,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-11T16:09:01.167357Z","id":"CVE-2025-67716","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:auth0:nextjs-auth0:*:*:*:*:*:node.js:*:*","versionStartIncluding":"4.9.0","versionEndExcluding":"4.12.1","matchCriteriaId":"49F414AC-40B3-474B-B15C-D6962933338C"}]}]}],"references":[{"url":"https://github.com/auth0/nextjs-auth0/commit/35eb321de3345ccf23e8c0d6f66c9f2f2f57d26c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-mr6f-h57v-rpj5","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}