CVE-2026-107369

Awaiting Analysis Awaiting Analysis - Queue

Auth0 Next.js SDK Same-Origin Bypass in Redirect Logic

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Okta

Description

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107369

EUVD

EUVD-2026-100481

Affected Vendors & Products

Vendor	Product	Version / Range
Auth0	nextjs-auth0	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

The auth0/nextjs-auth0 SDK has a flaw in how it handles the returnTo parameter during authentication. It validates that the URL is from the same origin but then reconstructs it in a way that browsers may interpret as an absolute or scheme-relative path. This can cause the redirect to unintended domains after authentication.

Impact Analysis

This vulnerability could allow attackers to redirect users to malicious domains after authentication. Users might unknowingly interact with harmful sites, leading to phishing attacks, credential theft, or other security breaches.

Mitigation Strategies

Update the auth0/nextjs-auth0 SDK to the latest version to ensure the returnTo parameter validation is fixed and redirects are handled securely.

Hi! I’m here to help you understand CVE-2026-107369. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70