Vulnerability	Vulnerable Version
M Improper Authorization next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Authorization by obtaining an issued JWT from an interrupted OAuth sign-in flow. An attacker can manually override the `next-auth.session-token` cookie value with this non-related JWT, allowing the attacker to create an empty/mock user and peek at logged-in user states. Notes: Only applications prior to version 4.24.5 that rely on the default Middleware authorization are affected. This vulnerability does not give access to other users' data, neither to resources that require proper authorization via scopes or other means. Regardless of the vulnerability, the existence of a NextAuth.js session state can provide simple authentication, but not authorization in your applications. How to fix Improper Authorization? Upgrade `next-auth` to version 4.24.5 or higher.	<4.24.5

Improper Authorization

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Authorization by obtaining an issued JWT from an interrupted OAuth sign-in flow. An attacker can manually override the next-auth.session-token cookie value with this non-related JWT, allowing the attacker to create an empty/mock user and peek at logged-in user states.

Notes:

Only applications prior to version 4.24.5 that rely on the default Middleware authorization are affected.
This vulnerability does not give access to other users' data, neither to resources that require proper authorization via scopes or other means.
Regardless of the vulnerability, the existence of a NextAuth.js session state can provide simple authentication, but not authorization in your applications.

How to fix Improper Authorization?

Upgrade next-auth to version 4.24.5 or higher.

<4.24.5

Go back to all versions of this package