next-auth 5.0.0-beta.25

Direct Vulnerabilities

Known vulnerabilities in the next-auth package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Check for Unusual or Exceptional Conditions next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the `getToken` function. An attacker can cause the application to throw an unhandled exception and disrupt service availability by sending a malformed Bearer authorization header to endpoints that directly invoke this function without proper exception handling. How to fix Improper Check for Unusual or Exceptional Conditions? Upgrade `next-auth` to version 4.24.15, 5.0.0-beta.32 or higher.	>=4.0.6 <4.24.15>=5.0.0-beta.0 <5.0.0-beta.32
C Incorrect Behavior Order: Validate Before Canonicalize next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address containing Unicode homoglyphs that bypass validation, causing the passwordless sign-in link to be delivered to an attacker-controlled mailbox. This is only exploitable if the email/magic-link provider is enabled, the default identifier normalizer is used, and the mail delivery service applies Unicode normalization to recipient addresses. How to fix Incorrect Behavior Order: Validate Before Canonicalize? Upgrade `next-auth` to version 4.24.15, 5.0.0-beta.32 or higher.	>=4.10.3 <4.24.15>=5.0.0-beta.1 <5.0.0-beta.32
H Improper Verification of Source of a Communication Channel next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via improper binding of OAuth check cookies to the provider that created them. An attacker can gain unauthorized access to a victim's account by linking their own account at a second provider to the victim's user through a provider confusion scenario. This is only exploitable if multiple OAuth/OIDC providers are configured, users are allowed to link additional providers while logged in, at least one provider's authorization request is observable by an attacker, and at least one target provider's callback can be satisfied without a PKCE verifier. How to fix Improper Verification of Source of a Communication Channel? Upgrade `next-auth` to version 4.24.15, 5.0.0-beta.32 or higher.	<4.24.15>=5.0.0-beta.1 <5.0.0-beta.32
C Not Failing Securely ('Failing Open') next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Not Failing Securely ('Failing Open') in the `auth` process. An attacker can gain unauthorized access to protected resources by triggering a server-side configuration error that causes the `auth` object to be populated with an error object, which is then treated as a valid session by existence-based authorization checks. This is only exploitable if the application relies solely on the existence of the `auth` object for access control and a server-side configuration error occurs. How to fix Not Failing Securely ('Failing Open')? Upgrade `next-auth` to version 5.0.0-beta.32 or higher.	>=5.0.0-beta.0 <5.0.0-beta.32
M Improper Neutralization next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Neutralization in the email validation component. An attacker can intercept sensitive authentication emails by submitting a specially crafted email address that manipulates the parsing logic, causing messages to be sent to an unintended mailbox. How to fix Improper Neutralization? Upgrade `next-auth` to version 4.24.12, 5.0.0-beta.30 or higher.	<4.24.12>=5.0.0-beta.0 <5.0.0-beta.30

Vulnerability

Vulnerable Version

Improper Check for Unusual or Exceptional Conditions