Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-32702— Reflected XSS from the callback handler's error query parameter

Quick assessment

Affected
auth0 nextjs-auth0
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Auth0是是一个身份验证代理，支持社会和企业身份提供者，包括Active Directory、LDAP、谷歌Apps和Salesforce。 Auth0 Next.js SDK 存在跨站脚本漏洞，该漏洞源于1.4.1及之前版本容易受到反射XSS的影响。攻击者可利用该漏洞可以通过在error查询参数中提供XSS有效负载来执行任意代码，然后由回调处理程序将其作为错误消息处理。

CVSS 8.0 · High EPSS 1.40% · P72

Possible ATT&CK Techniques 1 AI

T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-32702

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Reflected XSS from the callback handler's error query parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Auth0 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Auth0是是一个身份验证代理，支持社会和企业身份提供者，包括Active Directory、LDAP、谷歌Apps和Salesforce。 Auth0 Next.js SDK 存在跨站脚本漏洞，该漏洞源于1.4.1及之前版本容易受到反射XSS的影响。攻击者可利用该漏洞可以通过在error查询参数中提供XSS有效负载来执行任意代码，然后由回调处理程序将其作为错误消息处理。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
auth0 nextjs-auth0 < 1.4.2 -

II. Public POCs for CVE-2021-32702

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 6264 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2021-32702

请登录查看更多情报信息。

Patches & Fixes for CVE-2021-32702 (1)

Vendor Advisories for CVE-2021-32702 (1)

Other References for CVE-2021-32702 (1)

IV. Related Vulnerabilities

Same product: nextjs-auth0
Same vendor: auth0
Same weakness: CWE-79

V. Comments for CVE-2021-32702

No comments yet

Leave a comment