Improper Input Validation Affecting next-auth package, versions <3.29.8 >=4.0.0 <4.9.0



    Attack Complexity Low
    User Interaction Required
    Scope Changed
    Confidentiality High

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.06% (25th percentile)
Expand this section
6.1 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-NEXTAUTH-2944244
  • published 7 Jul 2022
  • disclosed 7 Jul 2022
  • credit Sandiipmaity

How to fix?

Upgrade next-auth to version 3.29.8, 4.9.0 or higher.


next-auth is an Authentication for Next.js

Affected versions of this package are vulnerable to Improper Input Validation via the email sign-in endpoint, due to lack of sanitization. Exploiting this vulnerability allows an attacker to send an HTML payload that will be displayed on the verification email sent to the email address.


If for some reason you cannot upgrade versions, the workaround requires you to sanitize the email parameter that is passed to sendVerificationRequest and rendered in the HTML.