Medium severity · published Dec 16, 2021
CVE-2021-43812
Open redirect in nextjs-auth0
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
nextjs-auth0 · auth0
< 1.6.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43812
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43812
Patch
https://github.com/auth0/nextjs-auth0/commit/0bbd9f8a0c93af51f607f28633b5fb18c5e48ad6
Third Party Advisory
https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-2mqv-4j3r-vjvp
More from nextjs-auth0
7.7
CVE-2025-48947
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
6.1
CVE-2026-107369
Improper Validation of Post-Login Redirect URL in nextjs-auth0
6.1
CVE-2021-32702
Reflected XSS from the callback handler's error query parameter
5.7
CVE-2025-67716
Auth0 Next.js SDK has Improper Validation of Query Parameters
5.4
CVE-2026-40155
Auth0 Next.js SDK has Improper Proxy Cache Lookup