Improper Input Validation Affecting next-auth package, versions <3.29.8 >=4.0.0 <4.9.0
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.11% (47th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NEXTAUTH-2944244
- published 7 Jul 2022
- disclosed 7 Jul 2022
- credit Sandiipmaity
Introduced: 7 Jul 2022
CVE-2022-31127 Open this link in a new tabHow to fix?
Upgrade next-auth to version 3.29.8, 4.9.0 or higher.
Overview
next-auth is an Authentication for Next.js
Affected versions of this package are vulnerable to Improper Input Validation via the email sign-in endpoint, due to lack of sanitization. Exploiting this vulnerability allows an attacker to send an HTML payload that will be displayed on the verification email sent to the email address.
Workaround:
If for some reason you cannot upgrade versions, the workaround requires you to sanitize the email parameter that is passed to sendVerificationRequest and rendered in the HTML.
References
CVSS Scores
version 3.1