CVE-2021-43812: Open redirect vulnerability in @auth0/nextjs-auth0
Summary
CVE-2021-43812: Open redirect in @auth0/nextjs-auth0. Affects @auth0/nextjs-auth0 versions < 1.6.2. Fixed in 1.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @auth0/nextjs-auth0 package is an npm package that provides authentication support for Next.js applications using Auth0. It allows developers to easily integrate Auth0 authentication into their Next.js projects. This package is vulnerable to an open redirect vulnerability in versions <=1.6.1.
Vulnerability Detail
The open redirect vulnerability in @auth0/nextjs-auth0 versions <=1.6.1 occurs due to the lack of filtering of certain 'returnTo' parameter values from the login URL. This vulnerability exposes the application to potential attacks where an attacker can craft a malicious URL that redirects users to a different website, leading to phishing attacks or other malicious activities. The impact of this vulnerability can range from unauthorized access to sensitive information to complete compromise of user accounts.
How To Fix
Minimum fixed version
1.6.2
This is the first release that contains the fix.
npm install @auth0/nextjs-auth0@1.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the @auth0/nextjs-auth0 package is vulnerable to an open redirect vulnerability in versions <=1.6.1. To mitigate this vulnerability, it is recommended to upgrade to version >=1.6.2. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @auth0/nextjs-auth0 →
FAQ
You are affected by this vulnerability if you are using @auth0/nextjs-auth0 version <=1.6.1.
No, the fix provided in the patch will not affect your users.
The severity of this vulnerability is considered moderate with a CVSS score of 6.4.
The CWE ID for this vulnerability is CWE-601.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-2mqv-4j3r-vjvp/GHSA-2mqv-4j3r-vjvp.json
References
Related vulnerabilities
Recent vulnerabilities recorded for @auth0/nextjs-auth0.
