Homepage

next-auth@4.0.0-next.8 vulnerabilities

Authentication for Next.js

  • latest version

    4.24.11

  • latest non vulnerable version

    5.0.0-beta.25

  • first published

    6 years ago

  • latest version published

    6 days ago

  • licenses detected

  • View next-auth package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the next-auth package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Authorization

    next-auth is an Authentication for Next.js

    Affected versions of this package are vulnerable to Improper Authorization by obtaining an issued JWT from an interrupted OAuth sign-in flow. An attacker can manually override the next-auth.session-token cookie value with this non-related JWT, allowing the attacker to create an empty/mock user and peek at logged-in user states.

    Notes:

    1. Only applications prior to version 4.24.5 that rely on the default Middleware authorization are affected.

    2. This vulnerability does not give access to other users' data, neither to resources that require proper authorization via scopes or other means.

    3. Regardless of the vulnerability, the existence of a NextAuth.js session state can provide simple authentication, but not authorization in your applications.

    How to fix Improper Authorization?

    Upgrade next-auth to version 4.24.5 or higher.

    <4.24.5
    • M
    Session Fixation

    next-auth is an Authentication for Next.js

    Affected versions of this package are vulnerable to Session Fixation such that a bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim.

    How to fix Session Fixation?

    Upgrade next-auth to version 4.20.1 or higher.

    <4.20.1
    • M
    Improper Authentication

    next-auth is an Authentication for Next.js

    Affected versions of this package are vulnerable to Improper Authentication due to missing validation for both the identifier and the token in the Upstash Redis adapter.

    How to fix Improper Authentication?

    Upgrade next-auth to version 4.12.0 or higher.

    <4.12.0
    • M
    Open Redirect

    next-auth is an Authentication for Next.js

    Affected versions of this package are vulnerable to Open Redirect when using a OAuth 1 provider.

    How to fix Open Redirect?

    Upgrade next-auth to version 3.29.3, 4.3.4 or higher.

    <3.29.3>=4.0.0-next.1 <4.3.4
    • M
    Open Redirect

    next-auth is an Authentication for Next.js

    Affected versions of this package are vulnerable to Open Redirect via defaultCallback, allowing for malicious actors to redirect the victim to a site of their choosing.

    How to fix Open Redirect?

    Upgrade next-auth to version 4.3.2 or higher.

    <4.3.2
    Go back to all versions of this package