Homepage
About Snyk

Improper Access Control Affecting next-auth package, versions <3.3.0

0.0
critical

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High

    Threat Intelligence

    EPSS 0.23% (61st percentile)
Expand this section
NVD
5.9 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-NEXTAUTH-1072465
  • published 12 Feb 2021
  • disclosed 11 Feb 2021
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 11 Feb 2021

CVE-2021-21310 Open this link in a new tab
CWE-284 Open this link in a new tab

How to fix?

Upgrade next-auth to version 3.3.0 or higher.

Overview

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Access Control. The Prisma database adapter was checking the verification token but not the identifier (the email address associated with the token). This made it possible to use a valid token assigned to one user, to sign in as another user when using the Prima adapter in conjunction with the Email provider. The defect is specific to the community-supported Prisma database adapter in versions <3.3.0 and is not present in the default database adapter (TypeORM).

References