The nextjs-auth0 SDK performs a same‑origin check on the returnTo query parameter but later rebuilds the URL for post‑authentication redirection. An attacker can supply a crafted returnTo value that, after reconstruction, resolves to an absolute or scheme‑relative URL interpreted by the browser as pointing to an external domain. This flaw enables an attacker to redirect a legitimate user away from the intended application after login, creating a phishing or credential‑stealing surface. The weakness is a redirection vulnerability (CWE‑601) and undermines the integrity of the authentication flow.

Auth0’s nextjs-auth0 SDK is affected, specifically any version earlier than 4.32.0. Updating to 4.32.0 or later eliminates the vulnerability.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation in the wild, and the vulnerability is currently not listed in the CISA KEV catalog. Exploitation requires an attacker to craft a login URL containing a malicious returnTo parameter; if users follow such a link, the SDK will reconstruct it and redirect them to an unintended domain. The attack surface is public and does not require elevated privileges, making the vulnerability feasible with minimal effort.