CVE-2025-67716 - CVE House
Back to Database
Status published Medium CVE-2025-67716

Auth0 Next.js SDK has Improper Validation of Query Parameters

Vulnerability Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-67716

Credits & Attribution

No credits recorded in the NVD database.

References

More from auth0

View All →
CVE-2025-68129
Auth0-PHP SDK has Improper Audience Validation
Medium 6.8
CVE-2025-67490
Auth0 Next.js SDK has Improper Request Caching Lookup
Medium 5.4
CVE-2025-65945
auth0/node-jws improper HMAC signature verification vulnerability
High 7.5
CVE-2025-58769
auth0-PHP: Improper File Type Handling in Bulk User Import
Low 3.3
CVE-2025-48951
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical 9.3

Affected Vendor

Affected Software

nextjs-auth0
Vulnerable Versions:
>= 4.9.0, < 4.13.0

Timeline

Official Publish: December 11th, 2025
Last Modified: December 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-184

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.