CVE-2025-13984 - Vulnerability Details - OpenCVE

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Next.js
Kanopi	Next.js

Configuration 1 [-]

OR	cpe:2.3:a:kanopi:next.js::::::drupal::*
	cpe:2.3:a:kanopi:next.js::::::drupal::*

No data.

References

Link	Providers
https://www.spirityenterprise.com/pentest
https://www.drupal.org/sa-contrib-2025-122

History

Fri, 06 Feb 2026 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Kanopi Kanopi next.js
CPEs		cpe:2.3:a:kanopi:next.js::::::drupal::*
Vendors & Products		Kanopi Kanopi next.js

Thu, 29 Jan 2026 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 29 Jan 2026 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal next.js
Vendors & Products		Drupal Drupal next.js

Wed, 28 Jan 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.
Title		Next.js - Critical - Access bypass - SA-CONTRIB-2025-122
Weaknesses		CWE-942
References		https://www.drupal.org/sa-contrib-2025-122

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-01-28T20:02:22.486Z

Updated: 2026-01-29T18:24:28.956Z

Reserved: 2025-12-03T17:04:25.507Z

Link: CVE-2025-13984

Vulnrichment

Updated: 2026-01-29T18:24:21.845Z

NVD

Status : Analyzed

Published: 2026-01-28T20:16:07.807

Modified: 2026-02-06T19:02:43.960

Link: CVE-2025-13984

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13984", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-12-03T17:04:25.507Z", "datePublished": "2026-01-28T20:02:22.486Z", "dateUpdated": "2026-01-29T18:24:28.956Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/next", "defaultStatus": "unaffected", "product": "Next.js", "repo": "https://git.drupalcode.org/project/next", "vendor": "Drupal", "versions": [{"lessThan": "1.6.4", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2.0.1", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mike Decker (pookmish)"}, {"lang": "en", "type": "remediation developer", "value": "Brian Perry (brianperry)"}, {"lang": "en", "type": "remediation developer", "value": "Rob Decker (rrrob)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Jess (xjm)"}], "datePublic": "2025-12-03T18:49:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).<p>This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.</p>"}], "value": "Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-942", "description": "CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-01-28T20:02:22.486Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-122"}], "source": {"discovery": "UNKNOWN"}, "title": "Next.js - Critical - Access bypass - SA-CONTRIB-2025-122", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T18:24:01.824775Z", "id": "CVE-2025-13984", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T18:24:28.956Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-13984", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T18:24:01.824775Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T18:24:21.845Z"}}], "cna": {"title": "Next.js - Critical - Access bypass - SA-CONTRIB-2025-122", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Mike Decker (pookmish)"}, {"lang": "en", "type": "remediation developer", "value": "Brian Perry (brianperry)"}, {"lang": "en", "type": "remediation developer", "value": "Rob Decker (rrrob)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Jess (xjm)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/next", "vendor": "Drupal", "product": "Next.js", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.6.4", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.1", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/next", "defaultStatus": "unaffected"}], "datePublic": "2025-12-03T18:49:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-122"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.", "supportingMedia": [{"type": "text/html", "value": "Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).<p>This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-01-28T20:02:22.486Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13984", "state": "PUBLISHED", "dateUpdated": "2026-01-29T18:24:28.956Z", "dateReserved": "2025-12-03T17:04:25.507Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-01-28T20:02:22.486Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}