CVE-2025-67716

Executive Summary

CVE-2025-67716 is an input-validation flaw in the Auth0 Next.js SDK, a library used to implement user authentication in Next.js applications. Affected versions 4.9.0 through 4.12.1 fail to properly validate the returnTo parameter, which allows an attacker to inject unintended OAuth query parameters into the Auth0 authorization request that the SDK constructs. A successful attack can result in identity tokens being issued with unintended parameters, which may in turn enable elevation of access or downstream abuse of the token. The vulnerability is fixed in SDK version 4.13.0; organizations running affected versions should prioritize the upgrade.

No public exploit code or Nuclei template is known, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. The EPSS score is low (0.00266), indicating a low current probability of in-the-wild exploitation, but the affected component sits directly in the authentication chain of public-facing applications, so the risk should not be dismissed.

Technical Analysis

The vulnerability belongs to the improper validation of query parameters class (CWE-20). According to the NVD description, the flaw resides in the handling of the returnTo parameter within the Auth0 Next.js SDK. The returnTo parameter is typically used to define the URL or path a user is redirected to after completing an authentication flow. In affected versions of the SDK (4.9.0 through 4.12.1), this value is concatenated into the Auth0 authorization request without sufficient validation of its structure.

The attack mechanism is a form of parameter injection into the authorization URL. When an attacker supplies a returnTo value that itself contains query-string syntax — for example, a value that carries additional key=value pairs separated by reserved characters such as & or ? — the SDK does not reject or sanitize the input. Instead, the malicious content is folded into the outgoing Auth0 authorization request. The injected query parameters are then processed by the Auth0 authorization endpoint, and the resulting authorization/token exchange reflects those injected parameters.

Because the flaw is an input-validation issue rather than a cryptographic or protocol-level weakness, no specific function names, class names, or SDK-internal API endpoints are referenced in the public description. Sufficient technical detail is not available to describe the exact code path; the analysis here is based on the vulnerability class and the parameter name (returnTo) explicitly identified by the CNA.

Additional packaging context: the OSV entry tracks the affected component at commit 0e83495ac6688e759e5ead54d4f27019a4773fbe with an "unfixed" marker, while the CNA advisory confirms that version 4.13.0 resolves the issue. This slight discrepancy between the OSV fix-state mapping and the CNA patch notice is the reason for the 3/4 (LIKELY) patch confidence rating.

The attack surface is the public-facing Next.js application that embeds the SDK. Any unauthenticated or semi-authenticated request that reaches the login flow and supplies a user-controlled returnTo value is a potential vector.

Exploitation Scenarios

Since no public PoC is available and the NVD description does not disclose implementation-level details, the attack chain below is inferred from the vulnerability class (parameter injection into an OAuth authorization request). It should be treated as the most probable exploitation path rather than a confirmed procedure.

1. Reconnaissance and target identification. An attacker identifies Next.js applications that use the Auth0 SDK. Fingerprinting can be performed by observing the authentication flow: the presence of Auth0-related redirect behavior, Auth0 login endpoints in the redirect chain, or SDK artifacts (source maps, package manifests, asset filenames) that reveal the affected version range 4.9.0–4.12.1.

2. Triggering the flaw. The attacker crafts a malicious returnTo value. Because the SDK fails to validate the parameter strictly, the supplied value can contain additional query-string segments (e.g., parameters introduced by an embedded ? or & separator). The attacker embeds this crafted value in a link that routes the victim into the application's Auth0 login flow, or supplies it directly to the endpoint that initiates the authorization request.

3. Payload and execution at the vulnerability-class level. When the SDK builds the Auth0 authorization request, the unvalidated returnTo content is appended such that the attacker-controlled query parameters become part of the authorization URL that Auth0 receives. In essence, the attacker overwrites or augments the OAuth parameters that the SDK intended to send, influencing the parameters under which the token is subsequently requested and issued.

4. Post-exploitation impact. If the injected parameters alter token attributes (such as the requested scope, audience, connection, or associated redirect handling), the victim may receive a token that was requested under attacker-influenced conditions. The attacker may then leverage the issued token — or the misconfigured token parameters — to access resources or APIs with unintended privileges or under an unintended audience. Token parameters may also cause the token exchange to behave in a way that benefits the attacker, depending on the downstream application logic.

It is important to emphasize: no public PoC, exploit code, or Nuclei template exists for this CVE at the time of writing. The scenario above is a reasonable reconstruction based strictly on the NVD description and the vulnerability class. Security teams should monitor for the release of additional technical detail or proof-of-concept material as disclosure matures.

Impact Assessment

The CVSS base score is 5.7 (Medium). The official vector string has not been published, so sub-score attribution (AV/AC/PR/UI/S/C/I/A) cannot be positively confirmed. Based on the vulnerability description, a realistic reading is that the attack requires user interaction (luring a user into clicking a crafted link), targets the integrity of the token-issuance process, and may lead to downstream unauthorized access.

Business impact: Because the vulnerable component is the authentication library itself, the blast radius is the entire user-authentication and session/bootstrap pipeline of affected applications. A successful exploit could result in tokens issued with unintended parameters, which is a direct integrity failure of the identity layer. Downstream, this could translate into unauthorized API access, privilege escalation, or account-takeover-adjacent conditions depending on how the application consumes the returned tokens.

Affected systems: Any Next.js application that integrates the Auth0 Next.js SDK in versions 4.9.0 through 4.12.1 and that surfaces a user-controllable returnTo parameter in its authentication flow.

Blast radius: Moderate. The vulnerability is remotely exploitable but requires a specific parameter to be attacker-influenced. No known in-the-wild exploitation, CISA KEV listing, or active threat-actor campaign has been reported. The low EPSS percentile (18.6% of scored CVEs) further suggests low current attacker interest.

Detection Guidance

Detection of this vulnerability is challenging because the malicious behavior appears as malformed returnTo query values within otherwise legitimate authentication traffic. The rules below focus on the distinguishing feature: a returnTo parameter that contains nested query-string separators (encoded & or ?) or double-encoded variants of the same, which are not produced by normal application usage. Note that the exact OAuth parameter names an attacker would inject are not specified in the public advisory; the rules therefore match on structural anomalies rather than on specific parameter names.

Sigma Rule

title: CVE-2025-67716 Auth0 Next.js SDK returnTo Parameter Injection
id: 5f3a91c0-7d24-4e6b-8f02-2b6d3a9c41e7
status: experimental
description: >
  Detects HTTP requests to web applications where the returnTo query parameter
  contains nested query-string syntax (encoded '&' or '?') or double-encoded
  equivalents, consistent with exploitation of the Auth0 Next.js SDK
  input-validation flaw CVE-2025-67716.
author: ValtersIT Threat Intelligence
date: 2025/06/01
logsource:
  category: webserver
  product: generic
detection:
  selection_url:
    cs-uri-query|contains: "returnTo="
  selection_nested:
    cs-uri-query|re: "returnTo=[^&]*(%26|%3F|%3f|%2526|%253F)"
  condition: selection_url and selection_nested
falsepositives:
  - Rare legitimate applications that intentionally transport complex URLs inside returnTo
  - URL re-encoding by some web proxies (low likelihood)
level: medium
tags:
  - attack.t1190
  - cve.2025-67716

YARA Rule

rule CVE_2025_67716_Auth0_Nextjs_SDK
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects vulnerable Auth0 Next.js SDK versions (4.9.0-4.12.1) or returnTo handling code in package manifests, lockfiles, and web application bundles"
        reference = "CVE-2025-67716"
        date = "2025-06-01"
        score = 57

    strings:
        $v9   = "4.9.0"
        $v10  = "4.10"
        $v11  = "4.11"
        $v12  = "4.12.1"
        $ret  = "returnTo" ascii nocase
        $sdk  = "auth0" ascii nocase
        $next = "nextjs" ascii nocase

    condition:
        any of ($v*) and $ret and $sdk and $next
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-67716 Auth0 Next.js SDK returnTo OAuth parameter injection attempt"; flow:established,to_server; http.uri; content:"returnTo="; nocase; pcre:"/returnTo=[^&\"]*(%26|%3F|%2526|%253F)/iU"; classtype:attempted-admin; reference:cve,2025-67716; sid:202567716; rev:1;)

Elastic Detection

any where event.category == "web" and url.query != null and
  stringContains(url.query, "returnTo=") and
  ( stringContains(url.query, "%26") or stringContains(url.query, "%3F") or
    stringContains(url.query, "%2526") or stringContains(url.query, "%253F") )

Splunk SPL Query

index=web sourcetype=access_combined
  uri_query IN (*returnTo=*)
  ( uri_query IN (*returnTo=*%26*, *returnTo=*%3F*, *returnTo=*%2526*, *returnTo=*%253F*) )
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip uri uri_query user_agent
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,">
  <rule id="100677" level="8" frequency="5" timeframe="60">
    <decoded_as>web</decoded_as>
    <field name="url">\.*returnTo=</field>
    <regex>returnTo=.*(%26|%3F|%2526|%253F)</regex>
    <description>CVE-2025-67716: Auth0 Next.js SDK returnTo parameter OAuth injection attempt detected</description>
    <group>attack,pci_dss_6.5,gdpr_32,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY) — the fix in version 4.13.0 is independently confirmed by the CNA and by OSV.

1. Immediate mitigations (compensating controls):

   • Upgrade the Auth0 Next.js SDK to version 4.13.0 as soon as possible. This is the only source-confirmed fix for CVE-2025-67716.
   • As a temporary compensating control, implement application-level strict validation/allowlisting of the returnTo value before it reaches the SDK (e.g., enforce that only approved internal paths are accepted, and reject any value containing query-string separators).
   • Deploy or tune the detection rules above on WAF, IDS/IPS, and log-analytics platforms to flag structurally abnormal returnTo values.
   • Monitor authentication-related logs for anomalous authorization requests (e.g., unexpected additional query parameters appended to the Auth0 authorization request).

2. Patch/upgrade steps:

   • Review the project's package manifest and lockfile; confirm whether the SDK version falls in the affected range 4.9.0 – 4.12.1.
   • Update the dependency to 4.13.0 or newer, then run the full authentication test suite (login, logout, callback, token exchange, redirect handling).
   • Verify that the OSV/package-manager security scanners in your CI/CD pipeline no longer flag the dependency.

3. Long-term hardening:

   • Subscribe to the Auth0 Next.js SDK repository release notifications and to NVD/OSV feeds so future SDK vulnerabilities are picked up immediately.
   • Treat all redirect and callback parameters as untrusted input; apply strict allowlist validation for every parameter that influences the authentication or token-issuance flow.
   • Add an automated dependency-scanning step to the build pipeline with build-breaking on known-vulnerable versions.
   • Periodically review the CISA KEV catalog; while CVE-2025-67716 is not currently listed, any future addition would signal active exploitation and should trigger an emergency upgrade.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-67716
• OSV Database Entry: https://osv.dev/vulnerability/CVE-2025-67716
• Auth0 Next.js SDK repository / release notes (fix in version 4.13.0): https://github.com/auth0/nextjs-auth0
• CISA Known Exploited Vulnerabilities Catalog (CVE-2025-67716 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor campaigns / in-the-wild evidence: None identified. No public PoC, exploit code, or Nuclei template is available, and the CVE is not in the CISA KEV catalog. The low EPSS score (0.00266) supports the assessment that no active mass exploitation is underway; organizations should still patch promptly because the affected component is part of the critical authentication path.