GHSA-2mqv-4j3r-vjvp

    Dashboard / Vulnerabilities / GHSA-2mqv-4j3r-vjvp

    GHSA-2mqv-4j3r-vjvp

    Published: 16 Dec 2021Last Modified: 8 Jul 2026

    Summary: Open redirect in @auth0/nextjs-auth0

    Details: ### Overview Versions `<=1.6.1` do not filter out certain `returnTo` parameter values from the login url, which expose the application to an open redirect vulnerability. ### Am I affected? You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `<=1.6.1`. ### How to fix that? Upgrade to version `>=1.6.2` ### Will this update impact my users? The fix provided in the patch will not affect your users.

    References: https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-2mqv-4j3r-vjvp, https://nvd.nist.gov/vuln/detail/CVE-2021-43812, https://github.com/auth0/nextjs-auth0/commit/0bbd9f8a0c93af51f607f28633b5fb18c5e48ad6, https://github.com/auth0/nextjs-auth0

    Affected packages

    Package

    Name: @auth0/nextjs-auth0

    Purl: pkg:npm/%40auth0/nextjs-auth0

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.6.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-2mqv-4j3r-vjvp | CVE-DB