CVE-2021-32702

The CVE-2021-32702 entry concerns the Auth0 Next.js SDK (@auth0/nextjs-auth0). Affected versions are 1.4.1 and earlier, vulnerable to reflected XSS via an error query parameter processed by the callback handler. The exploit is a reflected XSS that can execute arbitrary code when the error message...

CVE-2021-32702

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

CVE-2021-32702 Reflected XSS from the callback handler's error query parameter

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

CVE-2021-32702: Improper Neutralization of Input During Web Page Generation

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

Next.js < 9.3.2 Path Traversal

Versions of the Next.js framework before version 9.3.2 suffer from a vulnerability allowing an attacker, via a specially forged request, to access arbitrary files in the folder ".next". This vulnerability does not affect files outside the folder ".next". In general, the ".next" directory only hol...

NextAuth.js Security Vulnerability

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. A security vulnerability exists in NextAuth.js that stems from a token validation vulnerability...

CVE-2020-15242

Next.js versions =9.5.0 and 9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by...

CVE-2020-15242

Next.js versions =9.5.0 and 9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by...

Open redirect

Next.js versions =9.5.0 and 9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by...

CVE-2020-15242 Open Redirect in Next.js

Next.js versions =9.5.0 and 9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by...

CVE-2020-15242

CVE-2020-15242 concerns Next.js versions 9.5.0–9.5.3, affected by an open redirect caused by specially encoded paths used with the trailing slash redirect to external sites. The initial description and multiple connected sources consistently state the vulnerability can enable phishing-like redire...

CVE-2020-15242

Next.js versions =9.5.0 and 9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by...

Open Redirect

Overview Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain...

GHSA-X56P-C8CG-Q435 Open Redirect in Next.js versions

Impact - Affected: Users of Next.js between 9.5.0 and 9.5.3 - Not affected: Deployments on Vercel https://vercel.com are not affected - Not affected: Deployments using next export We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. Patches...

@blitzjs/server (>=0.16.5-canary.8, <=0.24.1), @brudi-toolbox/next (>=1.14.17-next.2, <=1.14.26) +32 more potentially affected by CVE-2020-15242 via next (>=9.5.0, <=9.5.4-canary.24)

next NPM version =9.5.0, =0.16.5-canary.8, =1.14.17-next.2, =1.13.4, =0.1.8-alpha.1, =0.0.1-1, =0.16.0, =0.31.0-RC.1, =1.10.8, =1.0.0-alpha.1, =1.0.0-alpha.0, =0.16.5-canary.8, =0.20.0 - cna-template-material-tailwindcss-reduxtoolkit 0.1.0 and more Source cves: CVE-2020-15242 Source advisory:...

@blitzjs/server (>=0.16.5-canary.8, <=0.24.1), @brudi-toolbox/next (>=1.14.17-next.2, <=1.14.26) +32 more potentially affected by CVE-2020-15242 via next (>=9.5.0, <=9.5.4-canary.24)

next NPM version =9.5.0, =0.16.5-canary.8, =1.14.17-next.2, =1.13.4, =0.1.8-alpha.1, =0.0.1-1, =0.16.0, =0.31.0-RC.1, =1.10.8, =1.0.0-alpha.1, =1.0.0-alpha.0, =0.16.5-canary.8, =0.20.0 - cna-template-material-tailwindcss-reduxtoolkit 0.1.0 and more Source cves: CVE-2020-15242 Source advisory:...

Open Redirect in Next.js versions

Impact - Affected: Users of Next.js between 9.5.0 and 9.5.3 - Not affected: Deployments on Vercel https://vercel.com are not affected - Not affected: Deployments using next export We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. Patches...

CVE-2020-15242: URL Redirection to Untrusted Site

Next.js versions =9.5.0 and 9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by...

PT-2020-14307

Name of the Vulnerable Software and Affected Versions Next.js versions 9.5.0 through 9.5.3 Description The issue allows for an Open Redirect, where specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. This redirect does not...

CVE-2020-5284

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory .next. This does not affect files outside of the dist directory .next. In general, the dist directory only holds build assets unless your applicatio...