Improper Verification of Source of a Communication Channel Affecting next-auth package, versions <4.24.15>=5.0.0-beta.1 <5.0.0-beta.32

next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via improper binding of OAuth check cookies to the provider that created them. An attacker can gain unauthorized access to a victim's account by linking their own account at a second provider to the victim's user through a provider confusion scenario. This is only exploitable if multiple OAuth/OIDC providers are configured, users are allowed to link additional providers while logged in, at least one provider's authorization request is observable by an attacker, and at least one target provider's callback can be satisfied without a PKCE verifier.

This vulnerability can be mitigated by enabling PKCE on every provider that supports it, avoiding logged-in account linking across multiple providers where one provider is lower-trust or attacker-observable, and treating account linking events as sensitive by adding audit logging, user notification, or out-of-band confirmation.

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub Release
• GitHub Release
• GitHub Release