Improper Authorization Affecting next-auth package, versions <4.24.5
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-NEXTAUTH-6069933
- published21 Nov 2023
- disclosed20 Nov 2023
- creditMagnus N. Malmquist, dastaj
Introduced: 20 Nov 2023
CVE-2023-48309 (opens in a new tab)How to fix?
Upgrade next-auth to version 4.24.5 or higher.
Overview
next-auth is an Authentication for Next.js
Affected versions of this package are vulnerable to Improper Authorization by obtaining an issued JWT from an interrupted OAuth sign-in flow. An attacker can manually override the next-auth.session-token cookie value with this non-related JWT, allowing the attacker to create an empty/mock user and peek at logged-in user states.
Notes:
Only applications prior to version 4.24.5 that rely on the default Middleware authorization are affected.
This vulnerability does not give access to other users' data, neither to resources that require proper authorization via scopes or other means.
Regardless of the vulnerability, the existence of a NextAuth.js session state can provide simple authentication, but not authorization in your applications.
Workaround
Developers can manually perform basic authentication:
import { withAuth } from "next-auth/middleware"
export default withAuth(/your middleware function/, { callbacks: { authorized: ({ token }) => !!token?.email } })