Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1014
_____________________________________________________________________

DATE                : 14/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running nextjs-auth0 (npm) versions
                                   prior to 4.32.0.

====================================================================
https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-5vvp-h2v6-59j6
_____________________________________________________________________

Improper Validation of Post-Login Redirect URL in nextjs-auth0
Moderate	femiajiboye-okta published GHSA-5vvp-h2v6-59j6 

Package
 @auth0/nextjs-auth0 (npm)

Affected versions
< 4.32.0

Patched versions
4.32.0


Description

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a
same-origin URL. The SDK then stores this value and, in a later step,
reconstructs it for the post-authentication redirect. The reconstruction
logic can produce a URL that browsers interpret as an absolute or
scheme-relative path, leading to a redirect to an unintended domain.


Preconditions

A user initiates an authentication flow using a link configured with a
custom returnTo parameter, and

After pathname decomposition and reconstruction, the resulting returnTo
value is processed by the browser as an absolute or scheme-relative URL.


Fix
Upgrade auth0/nextjs-auth0 to version 4.32.0 or greater.


Severity
Moderate
6.1/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVE ID
CVE-2026-107369

Weaknesses
WeaknessCWE-601

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================