{"id":"EUVD-2025-202629","revision":"764fc565f6104a29832d99824cbd8df0","records":[{"revision":"764fc565f6104a29832d99824cbd8df0","observedAt":"2026-11-09T04:10:27.897+00:00","statement":{"source":"euvd","id":"EUVD-2025-202629","aliases":["CVE-2025-67716","GHSA-mr6f-h57v-rpj5"],"title":"The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAut…","description":"The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","score":5.7,"severity":null}],"references":["https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-mr6f-h57v-rpj5","https://github.com/auth0/nextjs-auth0/commit/35eb321de3345ccf23e8c0d6f66c9f2f2f57d26c"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202629","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 11, 2025, 12:21:27 AM","dateUpdated":"Dec 11, 2025, 4:09:34 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-202629","identifiers":["EUVD-2025-202629","CVE-2025-67716","GHSA-mr6f-h57v-rpj5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}