Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Which Projects are Affected? Users are affected if they meet all of the following preconditions: - Applications using the auth0/nextjs-auth0 SDK, versions 4.12.0 to 4.17.0, and - Applications using the proxy handler /me/ and /my-org/ with DPoP enabled. Affected product and versions Auth0/nextjs-auth0 v4.12.0 to 4.17.0 Resolution Upgrade Auth0/nextjs-auth0 version to v4.18.0 or greater Acknowledgements Okta would like to thank Reynaldo Immanuel for their discovery and responsible disclosure.
Recommended action: Upgrade to 4.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An input-validation flaw in the returnTo parameter in the Auth0 Next.js SDK could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters Am I Affected? You are affected if you meet the following preconditions: - Applications using the auth0/nextjs-auth0 SDK version prior to 4.13.0 Affected product and versions Auth0/nextjs-auth0 versions = 4.9.0 and < 4.13.0 Resolution Upgrade Auth0/nextjs-auth0 version to v4.13.0 Acknowledgements Okta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.
Recommended action: Upgrade to 4.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using affected versions of the Next.js SDK, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. Am I Affected? You are affected if you meet the following preconditions: - Applications using the auth0/nextjs-auth0 SDK with a singleton client instance, versions 4.11.0, 4.11.1, and 4.12.0. Affected product and versions Auth0/nextjs-auth0 v4.11.0, v4.11.1, and v4.12.0. Resolution Upgrade Auth0/nextjs-auth0 version to v4.11.2 or v4.12.1 Acknowledgements Okta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.
Recommended action: Upgrade to 4.12.1 or 4.11.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Am I Affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, 2. Applications using CDN or edge caching that caches responses with the Set-Cookie header. 3. If the Cache-Control header is not properly set for sensitive responses. Fix Upgrade auth0/nextjs-auth0 to v4.6.1.
Recommended action: Upgrade to 4.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Auth0 NextJS v4.0.1 to v4.5.0 does not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. Am I Affected? You are affected if you are using Auth0 NextJS SDK v4. Fix Upgrade to v4.5.1.
Recommended action: Upgrade to 4.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions <=1.6.1 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Am I affected? You are affected by this vulnerability if you are using @auth0/nextjs-auth0 version <=1.6.1. How to fix that? Upgrade to version =1.6.2 Will this update impact my users? The fix provided in the patch will not affect your users.
Recommended action: Upgrade to 1.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message. Am I affected? You are affected by this vulnerability if you are using @auth0/nextjs-auth0 version 1.4.1 or lower unless you are using custom error handling that does not return the error message in an HTML response. How to fix that? Upgrade to version 1.4.2. Will this update impact my users? The fix adds basic HTML escaping to the error message and it should not impact your users. Credit https://github.com/inian https://github.com/git-ishanpatel
Recommended action: Upgrade to 1.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.