CVE-2021-43812

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

• CWE-601

• https://github.com/auth0/nextjs-auth0/commit/0bbd9f8a0c93af51f607f28633b5fb18c5e48ad6Patch, Third Party Advisory
• https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-2mqv-4j3r-vjvpThird Party Advisory
• https://github.com/auth0/nextjs-auth0/commit/0bbd9f8a0c93af51f607f28633b5fb18c5e48ad6Patch, Third Party Advisory
• https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-2mqv-4j3r-vjvpThird Party Advisory

Published

Dec 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43807Opencast is an Open Source Lecture Capture & Video Managemen…6.5
• CVE-2021-43808Laravel is a web application framework. Laravel prior to ver…6.1
• CVE-2021-43809`Bundler` is a package for managing application dependencies…7.3
• CVE-2021-4381The uListing plugin for WordPress is vulnerable to authoriza…9.8
• CVE-2021-43810Admidio is a free open source user management system for web…6.1
• CVE-2021-43811Sockeye is an open-source sequence-to-sequence framework for…7.8
• CVE-2021-43813Grafana is an open-source platform for monitoring and observ…4.3
• CVE-2021-43814Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2021-43815Grafana is an open-source platform for monitoring and observ…4.3
• CVE-2021-43816containerd is an open source container runtime. On installat…9.1
• CVE-2021-43817Collabora Online is a collaborative online office suite base…6.1
• CVE-2021-43818lxml is a library for processing XML and HTML in the Python …7.1