CVE-2026-107369

Executive Summary

CVE-2026-107369 is an open redirect vulnerability in the Auth0 nextjs-auth0 SDK affecting applications that rely on the SDK's returnTo parameter handling during authentication flows. The SDK validates returnTo as a same-origin URL at input time, but a reconstruction flaw later produces a URL that browsers interpret as absolute or scheme-relative, redirecting authenticated users to an attacker-controlled domain. With a CVSS score of 6.1, the impact is limited to confidentiality and integrity at Low severity with Scope Change, and exploitation requires user interaction; no public PoC exists and no patch has been released.

Technical Analysis

The vulnerability is a classic CWE-601 (URL Redirection to Untrusted Site / "Open Redirect"). The nextjs-auth0 SDK is designed to preserve a post-login destination via the returnTo parameter. According to the NVD description, the SDK performs an initial validation step that confirms returnTo is a same-origin URL. This validated value is then stored by the SDK and, in a later step, reconstructed to build the final post-authentication redirect target.

The defect lies in the reconstruction logic. Discrepancies between the SDK's URL parsing/serialization behavior and browser URL interpretation can yield a string that the browser treats as an absolute URL (one with an explicit scheme such as https:) or a scheme-relative URL (one beginning with //). Because browsers resolve such strings against the scheme or as network-path references rather than as same-origin relative paths, the resulting redirect can point to an unintended external domain despite the earlier same-origin check having passed.

This is a semantic mismatch between two URL parsers: the validation stage and the browser's resolution stage disagree on the meaning of the same string. The precise transformation that produces the divergent output is not described in the available intelligence; the description confirms only that the reconstruction "can produce a URL that browsers interpret as an absolute or scheme-relative path." No function names, parameters beyond returnTo, or code paths are specified in the source data, and none are invented here.

The attack surface is any web application that (a) integrates the nextjs-auth0 SDK and (b) propagates a caller-supplied returnTo value into the post-login redirect. Because the parameter is typically carried in the authentication request URL, it is reachable without authentication, aligning with the CVSS vector's AV:N/PR:N. The UI:R component reflects that a victim must click an attacker-crafted link and complete authentication for the redirect to fire.

Exploitation Scenarios

No public PoC or exploit code is available; the following chain is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a web application that uses the nextjs-auth0 SDK and accepts a returnTo parameter during login initiation. Such applications expose recognizable authentication routes and redirect parameters. Public fingerprinting can be performed via HTTP response inspection of the login endpoints.

2. Triggering the flaw class (open redirect via validation/reconstruction mismatch). The attacker crafts a URL containing a returnTo value that passes the SDK's same-origin same-origin validation at input time but, after the SDK stores and reconstructs it, is emitted as a string the browser interprets as absolute or scheme-relative. The attacker delivers this crafted link to a victim (phishing, email, chat, or embedded in a trusted-looking domain).

3. Payload / execution method (vulnerability-class level). The payload is a crafted returnTo value. It is not a code-execution payload; the exploitation primitive is a URL parsing confusion. The essential property is that the string survives the SDK's same-origin check yet reconstructs into a value whose browser interpretation escapes the origin. The exact string construction is not documented in the available intelligence and is not fabricated here.

4. Post-exploitation impact. The victim authenticates successfully at the legitimate application, then is redirected by the SDK to the attacker-controlled domain. Consequences include credential and session-token phishing (a convincing post-login destination that mimics the real app), OAuth authorization-code or token interception if the redirect target captures callback material, and loss of user trust. The CVSS subscores (C:L/I:L, S:C) indicate limited confidentiality and integrity impact with scope change — the vulnerable component's behavior affects resources beyond its intended security authority.

Impact Assessment

Successful exploitation yields an authenticated-looking redirect to an attacker-controlled domain. Business impact centers on phishing effectiveness and potential session or token exposure rather than direct code execution or data destruction. Because the redirect occurs after successful authentication, victims are more likely to trust the destination and enter additional credentials or approve actions.

CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 Medium.

• AV:N — the crafted link is deliverable over the network to any user.
• AC:L — no special conditions; the flaw triggers deterministically given a valid crafted returnTo.
• PR:N — no authentication is needed to craft or deliver the link.
• UI:R — the victim must click the link and complete authentication.
• S:C — the vulnerable SDK's redirect affects a domain outside its security scope.
• C:L / I:L — limited confidentiality and integrity impact (phishing/redirect abuse).
• A:N — no availability impact.

Blast radius is bounded by the number of applications integrating the vulnerable SDK version and exposing a returnTo-style redirect. EPSS is 0.00225 (12.2% percentile), indicating low current exploitation likelihood; CISA KEV status is NO, and no threat actor campaigns are known. The complete absence of version data means the full population of affected deployments cannot be precisely enumerated from available intelligence.

Detection Guidance

Sigma Rule

title: Potential nextjs-auth0 Open Redirect via returnTo Parameter
id: 8f2c1a4e-7b3d-4c9a-9e21-0d5b6a7c1f42
status: experimental
description: Detects authentication requests or redirects carrying a returnTo parameter with absolute or scheme-relative URL indicators, consistent with CVE-2026-107369 open redirect abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107369
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains: 'returnTo='
  selection_indicators:
    cs-uri-query|contains:
      - 'returnTo=//'
      - 'returnTo=%2F%2F'
      - 'returnTo=https'
      - 'returnTo=http'
      - 'returnTo=%68%74%74%70'
  condition: selection_param and selection_indicators
falsepositives:
  - Legitimate same-origin returnTo values that include encoded slashes
level: medium
tags:
  - attack.t1190
  - cwe.601

YARA Rule

rule CVE_2026_107369_nextjs_auth0_returnTo
{
    meta:
        description = "Detects suspicious returnTo parameter values indicative of open redirect abuse in nextjs-auth0 SDK (CVE-2026-107369)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107369"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $p1 = "returnTo=//" ascii
        $p2 = "returnTo=%2F%2F" ascii nocase
        $p3 = "returnTo=%2f%2f" ascii
        $p4 = "returnTo=http" ascii nocase
        $p5 = "returnTo=https" ascii nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107369 nextjs-auth0 open redirect returnTo parameter"; flow:established,to_server; http.uri; content:"returnTo="; nocase; pcre:"/returnTo=(%2F%2F|\/\/|https?%3A|https?)/i"; classtype:web-application-attack; reference:cve,2026-107369; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107369; sid:2026107369; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where url.query : "*returnTo=*" and
      (url.query : "*returnTo=//*" or url.query : "*returnTo=https*" or url.query : "*returnTo=http*" or url.query : "*returnTo=%2F%2F*") ]
  [ network where http.response.status_code : 302 and
      not destination.domain : "trusted.example.com" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval rt=urldecode(returnTo)
| where match(rt, "^https?://") OR match(rt, "^//") OR like(rt, "//%")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, url_host, rt
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-107369,">
  <rule id="107369" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>returnTo=</url>
    <regex type="pcre2">returnTo=(%2F%2F|\/\/|https?%3A|https?)</regex>
    <description>CVE-2026-107369: Possible nextjs-auth0 open redirect via returnTo parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_107369,open_redirect,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, workaround, or fixed version has been published in the tracked sources; the following are defensive measures independent of a vendor patch.

1. Immediate mitigations

   • Disable or override the SDK's automatic post-login redirect where returnTo is attacker-influenced. Replace with a strict server-side allowlist of permitted post-authentication destinations.
   • Canonicalize and re-validate returnTo immediately before redirect construction, not only at input time. Reject any value that begins with // or that contains a scheme (http:, https:, and other schemes) after decoding.
   • Normalize percent-encoding before validation to prevent encoded scheme/scheme-relative sequences from bypassing the check.

2. Patch / upgrade steps

   • Monitor the Auth0 nextjs-auth0 release channels and NVD for a fixed version. No CVE-specific patch currently exists; when released, upgrade the SDK to the patched version and re-test the redirect flow.
   • Pin the SDK version and integrate dependency scanning to detect the fix promptly.

3. Long-term hardening

   • Build redirect targets from a server-side map of known relative paths rather than reflecting client input.
   • Adopt parsers for validation and for URL construction only after confirming that validation and browser resolution semantics agree on absolute, scheme-relative, and encoded inputs.
   • Add automated tests covering scheme-relative and absolute URL payloads in returnTo handling.
   • Enable the detection rules above and monitor authentication redirect chains for out-of-origin hops.

References

• NVD — CVE-2026-107369: https://nvd.nist.gov/vuln/detail/CVE-2026-107369
• MITRE CWE-601 (URL Redirection to Untrusted Site / Open Redirect): https://cwe.mitre.org/data/definitions/601.html
• Auth0 nextjs-auth0 SDK repository and release notes: https://github.com/auth0/nextjs-auth0
• OWASP Unvalidated Redirects and Forwards Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
• CISA Known Exploited Vulnerabilities Catalog (KEV status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is available. No threat actor campaign or in-the-wild exploitation has been observed; CISA KEV status is NO and EPSS is 0.00225 (12.2% percentile).