{"id":"CVE-2026-107369","state":"PUBLISHED","title":"Improper Validation of Post-Login Redirect URL in nextjs-auth0","description":"The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain.","publishedAt":"2026-10-13T20:08:00.543Z","updatedAt":"2026-10-14T18:41:32.403Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"Okta"},"assigner":"Okta","products":["Auth0 nextjs-auth0"],"affected":[{"vendor":"Auth0","product":"nextjs-auth0","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.32.0","versionType":"semver"}]}],"references":["https://trust.okta.com/security-advisories/improper-validation-of-post-login-redirect-url-in-nextjs-auth0-cve-2026-107369","https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-5vvp-h2v6-59j6"],"weaknesses":["CWE-601"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/107xxx/CVE-2026-107369.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-107369","state":"PUBLISHED","datePublished":"2026-10-13T20:08:00.543Z","dateUpdated":"2026-10-14T18:41:32.403Z","assignerShortName":"Okta","assignerOrgId":"59b22baa-87b2-4371-8e4a-e080df12f74a","dateReserved":"2026-10-07T20:59:17.368Z"},"containers":{"cna":{"title":"Improper Validation of Post-Login Redirect URL in nextjs-auth0","descriptions":[{"lang":"en","value":"The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain."}],"affected":[{"vendor":"Auth0","product":"nextjs-auth0","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.32.0","versionType":"semver"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-validation-of-post-login-redirect-url-in-nextjs-auth0-cve-2026-107369"},{"url":"https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-5vvp-h2v6-59j6"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-601","lang":"en","description":"URL Redirection to Untrusted Site ('Open Redirect')"}]}],"providerMetadata":{"shortName":"Okta","orgId":"59b22baa-87b2-4371-8e4a-e080df12f74a","dateUpdated":"2026-10-13T20:15:54.239Z"},"solutions":[{"lang":"en","value":"Upgrade auth0/nextjs-auth0 to version 4.32.0 or greater."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-14T18:41:22.614149Z","id":"CVE-2026-107369","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-14T18:41:32.403Z"}}]}}}