next-auth@4.10.0 vulnerabilities

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Authorization by obtaining an issued JWT from an interrupted OAuth sign-in flow. An attacker can manually override the next-auth.session-token cookie value with this non-related JWT, allowing the attacker to create an empty/mock user and peek at logged-in user states.

Notes:

1. Only applications prior to version 4.24.5 that rely on the default Middleware authorization are affected.

2. This vulnerability does not give access to other users' data, neither to resources that require proper authorization via scopes or other means.

3. Regardless of the vulnerability, the existence of a NextAuth.js session state can provide simple authentication, but not authorization in your applications.

Upgrade next-auth to version 4.24.5 or higher.

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Session Fixation such that a bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim.

Upgrade next-auth to version 4.20.1 or higher.

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Authentication due to missing validation for both the identifier and the token in the Upstash Redis adapter.

Upgrade next-auth to version 4.12.0 or higher.

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Authorization in EmailProvider. This is if an attacker can forge a request that sends a comma-separated list of emails to the sign-in endpoint - NextAuth.js would send emails to both the attacker and the victim's e-mail addresses. The attacker could then login as a newly created user which means that basic authorization like email.endsWith("@victim.com") in the signIn callback would fail to communicate a threat to the developer.

Upgrade next-auth to version 3.29.10, 4.10.3 or higher.

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Information Exposure where it is possible to reveal sensitive information such as an identity provider's secret in logs.

Note: This vulnerability can be worked around by configuring the logger manually to remove the provider secret.

import log from "your-logging-service"
export const authOptions: NextAuthOptions = {
  debug: process.env.NODE_ENV !== "production",
  logger: {
    error: (code, metadata) => {
      if (!(metadata instanceof Error) &&  metadata.provider) {
        // redact the provider secret here
        delete metadata.provider
        log.error(code, metadata)
      } else {
        log.error(code, metadata)
      }
    }
  },
}

Upgrade next-auth to version 3.29.9, 4.10.2 or higher.