4.24.10
6 years ago
1 months ago
Known vulnerabilities in the next-auth package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for freeVulnerability | Vulnerable Version |
---|---|
next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Authorization by obtaining an issued JWT from an interrupted OAuth sign-in flow. An attacker can manually override the Notes:
How to fix Improper Authorization? Upgrade | <4.24.5 |
next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Session Fixation such that a bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim. How to fix Session Fixation? Upgrade | <4.20.1 |
next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Authentication due to missing validation for both the identifier and the token in the How to fix Improper Authentication? Upgrade | <4.12.0 |
next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Authorization in How to fix Improper Authorization? Upgrade | <3.29.10>=4.10.0 <4.10.3 |
next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Information Exposure where it is possible to reveal sensitive information such as an identity provider's secret in logs. Note: This vulnerability can be worked around by configuring the logger manually to remove the provider secret.
How to fix Information Exposure? Upgrade | <3.29.9>=4.0.0 <4.10.2 |
next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Input Validation via the email sign-in endpoint, due to lack of sanitization. Exploiting this vulnerability allows an attacker to send an HTML payload that will be displayed on the verification email sent to the email address. How to fix Improper Input Validation? Upgrade | <3.29.8>=4.0.0 <4.9.0 |
next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Denial of Service (DoS) due to improper handling of How to fix Denial of Service (DoS)? Upgrade | <3.29.5>=4.0.0 <4.5.0 |
next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Open Redirect when using a How to fix Open Redirect? Upgrade | <3.29.3>=4.0.0-next.1 <4.3.4 |
next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Open Redirect via How to fix Open Redirect? Upgrade | <4.3.2 |
next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Access Control. The Prisma database adapter was checking the verification token but not the identifier (the email address associated with the token). This made it possible to use a valid token assigned to one user, to sign in as another user when using the Prima adapter in conjunction with the Email provider. The defect is specific to the community-supported Prisma database adapter in versions <3.3.0 and is not present in the default database adapter (TypeORM). How to fix Improper Access Control? Upgrade | <3.3.0 |