The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications.

Timeline

Detection, updates, and resolution for this record.

1. Dec 11, 2025 · NIST NVD

   Detected

   The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fix

2. Oct 14, 2026 · NIST NVD

   Updated

   The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fix

Affected

• cpe auth0/nextjs-auth0version unspecified

Sources

• CVE.orgCVE-2025-67716

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2025-67716

  30-day exploitation probability 0.3%

  first.org
• NIST NVDCVE-2025-67716

  The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 author

  nvd.nist.gov

References

• Patch · github.com
• Vendor Advisory · github.com