CVE-2026-107369: URL Redirection to Untrusted Site ('Open Redirect') in Auth0 nextjs-auth0

The vulnerability in Auth0's nextjs-auth0 SDK involves improper reconstruction of the returnTo parameter used for post-authentication redirects. Although the SDK initially validates that returnTo is a same-origin URL, the reconstruction logic can produce URLs that browsers treat as absolute or scheme-relative paths, enabling an attacker to redirect users to untrusted external sites.

Successful exploitation allows an attacker to redirect authenticated users to arbitrary external domains, potentially facilitating phishing or other social engineering attacks. The vulnerability impacts confidentiality and integrity by misleading users about the destination of the redirect. There is no indication of direct code execution or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should carefully validate and sanitize redirect URLs in their implementation of nextjs-auth0 to prevent open redirect scenarios.