An input-validation flaw in the returnTo parameter in the Auth0 Next.js SDK could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters
You are affected if you meet the following preconditions:
Applications using the auth0/nextjs-auth0 SDK version >= 4.9.0 and < 4.13.0
Upgrade Auth0/nextjs-auth0 version to v4.13.0
Okta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.
Improper Validation of Query Parameters in Auth0 Next.js SDK
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。