CVE-2021-32702: falha de alta gravidade em auth0 nextjs-auth0
Reflected XSS from the callback handler's error query parameter
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8epss 1.4%
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
auth0 · nextjs-auth0CVEs relacionadas — auth0 nextjs-auth0
No mesmo produto, das mais perigosas para as menos.
CVE-2021-43812MEDIUMOpen redirect in nextjs-auth0EPSS 0.7%CVE-2025-46344MEDIUMAuth0 NextJS SDK v4 Missing Session InvalidationEPSS 0.4%CVE-2025-48947HIGHNextJS-Auth0 SDK Vulnerable to CDN Caching of Session CookiesEPSS 0.4%CVE-2025-67716MEDIUMAuth0 Next.js SDK has Improper Validation of Query ParametersEPSS 0.3%CVE-2025-67490MEDIUMAuth0 Next.js SDK has Improper Request Caching LookupEPSS 0.2%CVE-2026-40155MEDIUMAuth0 Next.js SDK has Improper Proxy Cache LookupEPSS 0.2%