CVE-2021-32702

    Dashboard / Vulnerabilities / CVE-2021-32702

    CVE-2021-32702

    Published: 25 Jun 2021Last Modified: 9 Jul 2026

    Summary:

    Details: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.

    References: https://www.npmjs.com/package/%40auth0/nextjs-auth0, https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-954c-jjx6-cxv7, https://github.com/auth0/nextjs-auth0/commit/6996e2528ceed98627caa28abafbc09e90163ccf

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ae4a7c680cad4f481eb317a910feb9d8205c27dc

    Affected versions

    v1.4.1
    v1.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32702 | CVE-DB