CVE-2021-43812 MEDIUM

CVE-2021-43812: Open redirect in nextjs-auth0

Vendor Auth0
Product nextjs-auth0
Weakness CWE-601 · Open redirect
Published December 16, 2021
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

December 16, 2021 CVE published
August 4, 2024 Record updated