AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OktaOKTA-0IICB6P

Improper Validation of Query Parameters in Auth0 Next.js SDK

Okta

CVE-2025-67716 · Published Dec 10, 2025

Medium5.7
No fix yet
Okta advisory

An input-validation flaw in the returnTo parameter in the Auth0 Next.js SDK could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. To remediate, upgrade Auth0/nextjs-auth0 version to v4.13.0

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 11Severity: Unrated to Medium
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Severity from
NVD

More Okta advisories

All Okta
High 8.2Apr 1Insufficient Entropy in Cookie Encryption in Auth0 Symfony SDKCVE-2026-34236no fix yetMedium 5.4Dec 10, 2025Improper Request Caching Lookup in the Auth0 Next.js SDKCVE-2025-67490no fix yetMedium 5.3Dec 10, 2025Improper Memory Cleanup in the Okta Java SDKCVE-2025-66033no fix yetHigh 8.4Dec 10, 2025Race condition in the Okta Java SDKCVE-2025-67505no fix yetHigh 7.5Dec 4, 2025Improper HMAC Signature Verification in auth0/node-jwsCVE-2025-65945no fix yetLow 3.3Oct 1, 2025Improper File Type Handling in Bulk User Import in Auth0 Wordpress pluginCVE-2025-58769no fix yet