next-auth 3.0.0-beta.2 vulnerabilities

Known vulnerabilities in the next-auth package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
M Improper Authorization next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Authorization by obtaining an issued JWT from an interrupted OAuth sign-in flow. An attacker can manually override the `next-auth.session-token` cookie value with this non-related JWT, allowing the attacker to create an empty/mock user and peek at logged-in user states. Notes: Only applications prior to version 4.24.5 that rely on the default Middleware authorization are affected. This vulnerability does not give access to other users' data, neither to resources that require proper authorization via scopes or other means. Regardless of the vulnerability, the existence of a NextAuth.js session state can provide simple authentication, but not authorization in your applications. How to fix Improper Authorization? Upgrade `next-auth` to version 4.24.5 or higher.	<4.24.5
M Session Fixation next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Session Fixation such that a bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim. How to fix Session Fixation? Upgrade `next-auth` to version 4.20.1 or higher.	<4.20.1
M Improper Authentication next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Authentication due to missing validation for both the identifier and the token in the `Upstash Redis` adapter. How to fix Improper Authentication? Upgrade `next-auth` to version 4.12.0 or higher.	<4.12.0
C Improper Authorization next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Authorization in `EmailProvider`. This is if an attacker can forge a request that sends a comma-separated list of emails to the sign-in endpoint - `NextAuth.js` would send emails to both the attacker and the victim's e-mail addresses. The attacker could then login as a newly created user which means that basic authorization like `email.endsWith("@victim.com")` in the `signIn` callback would fail to communicate a threat to the developer. How to fix Improper Authorization? Upgrade `next-auth` to version 3.29.10, 4.10.3 or higher.	<3.29.10>=4.10.0 <4.10.3
L Information Exposure next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Information Exposure where it is possible to reveal sensitive information such as an identity provider's secret in logs. Note: This vulnerability can be worked around by configuring the logger manually to remove the provider secret. `import log from "your-logging-service" export const authOptions: NextAuthOptions = { debug: process.env.NODE_ENV !== "production", logger: { error: (code, metadata) => { if (!(metadata instanceof Error) && metadata.provider) { // redact the provider secret here delete metadata.provider log.error(code, metadata) } else { log.error(code, metadata) } } }, }` How to fix Information Exposure? Upgrade `next-auth` to version 3.29.9, 4.10.2 or higher.	<3.29.9>=4.0.0 <4.10.2
H Improper Input Validation next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Input Validation via the email sign-in endpoint, due to lack of sanitization. Exploiting this vulnerability allows an attacker to send an HTML payload that will be displayed on the verification email sent to the email address. How to fix Improper Input Validation? Upgrade `next-auth` to version 3.29.8, 4.9.0 or higher.	<3.29.8>=4.0.0 <4.9.0
H Denial of Service (DoS) next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Denial of Service (DoS) due to improper handling of `callbackUrl`. Exploiting this vulnerability could be done via sending an invalid `callbackUrl` query parameter, causing an unhandled error to be thrown, leading to the API route handler timing out and the logging in to fail. How to fix Denial of Service (DoS)? Upgrade `next-auth` to version 3.29.5, 4.5.0 or higher.	<3.29.5>=4.0.0 <4.5.0
M Open Redirect next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Open Redirect when using a `OAuth 1` provider. How to fix Open Redirect? Upgrade `next-auth` to version 3.29.3, 4.3.4 or higher.	<3.29.3>=4.0.0-next.1 <4.3.4
M Open Redirect next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Open Redirect via `defaultCallback`, allowing for malicious actors to redirect the victim to a site of their choosing. How to fix Open Redirect? Upgrade `next-auth` to version 4.3.2 or higher.	<4.3.2
C Improper Access Control next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Access Control. The Prisma database adapter was checking the verification token but not the identifier (the email address associated with the token). This made it possible to use a valid token assigned to one user, to sign in as another user when using the Prima adapter in conjunction with the Email provider. The defect is specific to the community-supported Prisma database adapter in versions <3.3.0 and is not present in the default database adapter (TypeORM). How to fix Improper Access Control? Upgrade `next-auth` to version 3.3.0 or higher.	<3.3.0

Vulnerability

Vulnerable Version

Improper Authorization

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Authorization by obtaining an issued JWT from an interrupted OAuth sign-in flow. An attacker can manually override the next-auth.session-token cookie value with this non-related JWT, allowing the attacker to create an empty/mock user and peek at logged-in user states.

Notes:

Only applications prior to version 4.24.5 that rely on the default Middleware authorization are affected.
This vulnerability does not give access to other users' data, neither to resources that require proper authorization via scopes or other means.
Regardless of the vulnerability, the existence of a NextAuth.js session state can provide simple authentication, but not authorization in your applications.

How to fix Improper Authorization?

Upgrade next-auth to version 4.24.5 or higher.

<4.24.5

Session Fixation

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Session Fixation such that a bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim.

How to fix Session Fixation?

Upgrade next-auth to version 4.20.1 or higher.

<4.20.1

Improper Authentication

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Authentication due to missing validation for both the identifier and the token in the Upstash Redis adapter.

How to fix Improper Authentication?

Upgrade next-auth to version 4.12.0 or higher.

<4.12.0

Improper Authorization

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Authorization in EmailProvider. This is if an attacker can forge a request that sends a comma-separated list of emails to the sign-in endpoint - NextAuth.js would send emails to both the attacker and the victim's e-mail addresses. The attacker could then login as a newly created user which means that basic authorization like email.endsWith("@victim.com") in the signIn callback would fail to communicate a threat to the developer.

How to fix Improper Authorization?

Upgrade next-auth to version 3.29.10, 4.10.3 or higher.

<3.29.10>=4.10.0 <4.10.3

Information Exposure

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Information Exposure where it is possible to reveal sensitive information such as an identity provider's secret in logs.

Note: This vulnerability can be worked around by configuring the logger manually to remove the provider secret.

import log from "your-logging-service"
export const authOptions: NextAuthOptions = {
  debug: process.env.NODE_ENV !== "production",
  logger: {
    error: (code, metadata) => {
      if (!(metadata instanceof Error) &&  metadata.provider) {
        // redact the provider secret here
        delete metadata.provider
        log.error(code, metadata)
      } else {
        log.error(code, metadata)
      }
    }
  },
}

How to fix Information Exposure?

Upgrade next-auth to version 3.29.9, 4.10.2 or higher.

<3.29.9>=4.0.0 <4.10.2

Improper Input Validation

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Input Validation via the email sign-in endpoint, due to lack of sanitization. Exploiting this vulnerability allows an attacker to send an HTML payload that will be displayed on the verification email sent to the email address.

How to fix Improper Input Validation?

Upgrade next-auth to version 3.29.8, 4.9.0 or higher.

<3.29.8>=4.0.0 <4.9.0

Denial of Service (DoS)

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Denial of Service (DoS) due to improper handling of callbackUrl. Exploiting this vulnerability could be done via sending an invalid callbackUrl query parameter, causing an unhandled error to be thrown, leading to the API route handler timing out and the logging in to fail.

How to fix Denial of Service (DoS)?

Upgrade next-auth to version 3.29.5, 4.5.0 or higher.

<3.29.5>=4.0.0 <4.5.0

Open Redirect

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Open Redirect when using a OAuth 1 provider.

How to fix Open Redirect?

Upgrade next-auth to version 3.29.3, 4.3.4 or higher.

<3.29.3>=4.0.0-next.1 <4.3.4

Open Redirect

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Open Redirect via defaultCallback, allowing for malicious actors to redirect the victim to a site of their choosing.

How to fix Open Redirect?

Upgrade next-auth to version 4.3.2 or higher.

<4.3.2

Improper Access Control

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Access Control. The Prisma database adapter was checking the verification token but not the identifier (the email address associated with the token). This made it possible to use a valid token assigned to one user, to sign in as another user when using the Prima adapter in conjunction with the Email provider. The defect is specific to the community-supported Prisma database adapter in versions <3.3.0 and is not present in the default database adapter (TypeORM).

How to fix Improper Access Control?

Upgrade next-auth to version 3.3.0 or higher.

<3.3.0

next-auth@3.0.0-beta.2 vulnerabilities

Authentication for Next.js

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?