@auth/core@0.0.0-manual.3f95eefa
Authentication for the Web.
latest version
0.41.3
latest non vulnerable version
first published
3 years ago
latest version published
1 months ago
Direct Vulnerabilities
Known vulnerabilities in the @auth/core package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
@auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via improper binding of OAuth check cookies to the provider that created them. An attacker can gain unauthorized access to a victim's account by linking their own account at a second provider to the victim's user through a provider confusion scenario. This is only exploitable if multiple OAuth/OIDC providers are configured, users are allowed to link additional providers while logged in, at least one provider's authorization request is observable by an attacker, and at least one target provider's callback can be satisfied without a PKCE verifier. How to fix Improper Verification of Source of a Communication Channel? Upgrade | <0.41.3 |
@auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Improper Neutralization in the email validation component. An attacker can intercept sensitive authentication emails by submitting a specially crafted email address that manipulates the parsing logic, causing messages to be sent to an unintended mailbox. How to fix Improper Neutralization? Upgrade | <0.41.1 |