Nextjs Auth0
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Nextjs Auth0.
By the Year
In 2026 there have been 1 vulnerability in Nextjs Auth0 with an average score of 5.4 out of ten. Last year, in 2025 Nextjs Auth0 had 2 security vulnerabilities published. Right now, Nextjs Auth0 is on track to have less security vulnerabilities in 2026 than it did last year. Last year, the average CVE base score was greater by 0.15
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1 | 5.40 |
| 2025 | 2 | 5.55 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 2 | 6.10 |
It may take a day or so for new Nextjs Auth0 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Nextjs Auth0 Security Vulnerabilities
Auth0 Next.js SDK nonce retry causing cache lookup flaw 4.12.0-4.17.1
CVE-2026-40155
5.4 - Medium
- April 17, 2026
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.
AuthZ
Auth0 Next.js SDK 4.9.0-4.12.1 returnTo Validation Flaw (OAuth Params Injection)
CVE-2025-67716
5.7 - Medium
- December 11, 2025
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.
Denylist / Deny List
Auth0 Next.js SDK 4.11.04.11.2/4.12.0 TokenCache Race Condition
CVE-2025-67490
5.4 - Medium
- December 10, 2025
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.
AuthZ
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications
CVE-2021-43812
6.1 - Medium
- December 16, 2021
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
Open Redirect
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications
CVE-2021-32702
6.1 - Medium
- June 25, 2021
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Nextjs Auth0 or by Auth0? Click the Watch button to subscribe.
