Improper Access Control Affecting next-auth package, versions <3.3.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NEXTAUTH-1072465
- published 12 Feb 2021
- disclosed 11 Feb 2021
- credit Unknown
Introduced: 11 Feb 2021
CVE-2021-21310 Open this link in a new tabHow to fix?
Upgrade next-auth to version 3.3.0 or higher.
Overview
next-auth is an Authentication for Next.js
Affected versions of this package are vulnerable to Improper Access Control. The Prisma database adapter was checking the verification token but not the identifier (the email address associated with the token). This made it possible to use a valid token assigned to one user, to sign in as another user when using the Prima adapter in conjunction with the Email provider. The defect is specific to the community-supported Prisma database adapter in versions <3.3.0 and is not present in the default database adapter (TypeORM).