next-auth@3.29.10 vulnerabilities

Authentication for Next.js

Known vulnerabilities in the next-auth package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
M Session Fixation next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Session Fixation such that a bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim. How to fix Session Fixation? Upgrade `next-auth` to version 4.20.1 or higher.	<4.20.1
M Improper Authentication next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Authentication due to missing validation for both the identifier and the token in the `Upstash Redis` adapter. How to fix Improper Authentication? Upgrade `next-auth` to version 4.12.0 or higher.	<4.12.0
M Open Redirect next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Open Redirect via `defaultCallback`, allowing for malicious actors to redirect the victim to a site of their choosing. How to fix Open Redirect? Upgrade `next-auth` to version 4.3.2 or higher.	<4.3.2