Threat database

CVE-2026-107369 is an open redirect vulnerability in the Auth0 nextjs-auth0 SDK. The SDK attempts to validate the returnTo parameter as a same-origin URL but reconstructs it in a way that browsers may interpret as an absolute or scheme-relative URL, allowing redirection to unintended external domains. This can lead to potential phishing or redirection attacks after authentication.

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.