Auth0 Next.js SDK Input-Validation Vulnerability Allowing OAuth Parameter Injection

A vulnerability exists in the Auth0 Next.js SDK, specifically in versions 4.9.0 prior to 4.13.0. The issue arises from improper validation of the returnTo parameter, which could enable attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Exploitation of this flaw may lead to the issuance of tokens with unintended parameters.

Impact

Exploitation of this vulnerability could result in the injection of malicious OAuth parameters, potentially allowing for unauthorized actions or access within the application.

Reproduction

The vulnerability can be reproduced by using the Auth0 Next.js SDK version prior to 4.13.0 and crafting a returnTo parameter that includes malicious OAuth query parameters. This can be done by manipulating the returnTo value to inject additional query parameters that could be interpreted by the OAuth process.

Remediation

Users are advised to upgrade the Auth0 Next.js SDK to version 4.13.0 or later.