Medium severity · published Dec 11, 2025
CVE-2025-67716
Auth0 Next.js SDK has Improper Validation of Query Parameters
5.7
CVSS
0.3%
EPSS
No
On KEV
Description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
nextjs-auth0 · auth0
>= 4.9.0, < 4.13.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67716
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67716
Patch
https://github.com/auth0/nextjs-auth0/commit/35eb321de3345ccf23e8c0d6f66c9f2f2f57d26c
Vendor Advisory
https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-mr6f-h57v-rpj5
More from nextjs-auth0
7.7
CVE-2025-48947
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
6.1
CVE-2026-107369
Improper Validation of Post-Login Redirect URL in nextjs-auth0
6.1
CVE-2021-43812
Open redirect in nextjs-auth0
6.1
CVE-2021-32702
Reflected XSS from the callback handler's error query parameter
5.4
CVE-2026-40155
Auth0 Next.js SDK has Improper Proxy Cache Lookup