CVE-2025-67716: 
JavaScript vulnerability analysis and mitigation

CVE-2025-67716 is an OAuth query parameter injection vulnerability in the Auth0 Next.js SDK (@auth0/nextjs-auth0) caused by improper validation of the returnTo parameter. It affects versions 4.9.0 through 4.12.1 (exclusive of 4.13.0) of the npm package. The vulnerability was discovered by Joshua Rogers (MegaManSec) and disclosed via responsible disclosure on December 10, 2025. The CVSS v3.1 base score is 5.7 (Medium) per the Auth0 security advisory, though the GitHub Advisory Database rates it 3.7 (Low) under a slightly different scoring interpretation (GitHub Advisory, GHSA).

The root cause is CWE-184 (Incomplete List of Disallowed Inputs): the returnTo parameter value was interpolated directly into the login redirect URL without URL encoding, allowing special characters such as &, =, and ? to be interpreted as additional query parameters by the OAuth authorization server. Specifically, in src/server/helpers/with-page-auth-required.ts, the redirect was constructed as `${config.loginUrl}?returnTo=${returnTo}` without calling encodeURIComponent(), meaning a returnTo value like /callback?scope=openid profile&audience=https://api.example.com would be passed as raw query parameters to the Auth0 /authorize endpoint. The fix replaces the interpolation with encodeURIComponent(returnTo) to neutralize injected parameters (GitHub Commit, GitHub Advisory). Exploitation requires high privileges and user interaction, limiting the practical attack surface.

Successful exploitation could result in OAuth tokens being issued with unintended parameters — for example, an attacker could inject a crafted scope or audience parameter into the authorization request, potentially causing the authorization server to issue tokens with elevated or unintended permissions. This affects both confidentiality and integrity of the authentication flow, though availability is not impacted. The vulnerability does not directly expose credentials or session data, but could be leveraged to manipulate the OAuth flow in ways that benefit a privileged attacker (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.044% (14th percentile), indicating a low probability of exploitation in the near term (GHSA). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges and user interaction, significantly constraining the realistic threat.

1. Identify a vulnerable application: Locate a Next.js application using @auth0/nextjs-auth0 versions 4.9.0–4.12.1 that uses the withPageAuthRequired helper with a user-controlled or attacker-influenced returnTo parameter.
2. Craft a malicious returnTo value: Construct a returnTo string containing injected OAuth parameters, e.g., /callback?scope=openid profile email&audience=https://attacker-api.example.com.
3. Trigger the redirect: Cause the application to invoke withPageAuthRequired with the malicious returnTo value — this may require high-privilege access or social engineering a privileged user to visit a crafted URL.
4. Observe the authorization request: The SDK constructs a login redirect URL such as /auth/login?returnTo=/callback?scope=openid profile email&audience=https://attacker-api.example.com, where the injected parameters are appended as raw query parameters to the Auth0 /authorize endpoint.
5. Receive token with unintended parameters: If the Auth0 tenant honors the injected parameters, the resulting token may be issued with unintended scopes or audience values, potentially granting broader access than intended (GitHub Advisory, GitHub Commit).

• Network: Outbound OAuth authorization requests from the application server to the Auth0 /authorize endpoint containing unexpected query parameters such as scope, audience, or response_type appended after the returnTo value (e.g., ?returnTo=/callback?scope=openid+profile&audience=...).
• Logs: Application or web server access logs showing login redirect URLs with unencoded special characters (&, =, ?) within the returnTo query parameter value.
• Auth0 Logs: Auth0 tenant logs showing authorization requests with unusual or unexpected scope or audience values that differ from the application's configured defaults.

Upgrade @auth0/nextjs-auth0 to version 4.13.0 or later, which applies encodeURIComponent() to the returnTo parameter before constructing the login redirect URL (GitHub Advisory, GitHub Commit). For organizations unable to patch immediately, implement additional server-side validation of the returnTo parameter to reject or sanitize values containing OAuth-significant characters (&, =, ?). Additionally, review Auth0 tenant configuration to ensure that only explicitly allowed scopes and audiences can be requested, reducing the impact of any injected parameters.

The vulnerability was acknowledged by Okta (Auth0's parent company), which credited Joshua Rogers (MegaManSec) for responsible disclosure in the official security advisory (GitHub Advisory). No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database entries.