NextAuth.js EUVD-2026-57601

Exploitation requires ALL of the following conditions to hold simultaneously: the application configures multiple OAuth/OIDC providers; authenticated users are permitted to link additional providers via Auth.js account-linking; at least one configured provider's authorization request is observable by the attacker (e.g., a well-known or attacker-influenced authorization server endpoint or redirect URI); and at least one target provider's callback can be satisfied using only the state or nonce cookie without a PKCE verifier, meaning that provider does not mandate PKCE on the relying party. Applications using a single OAuth provider are explicitly not affected. Applications that do not allow logged-in account linking are explicitly not affected. Applications where every configured provider enforces PKCE are explicitly not affected. Additionally, exploitation requires the victim to actively initiate a legitimate same-origin OAuth flow, which the attacker cannot force via CSRF alone - social engineering or a crafted same-origin link is required. CVSS PR:N reflects that the attacker requires no authentication on the target application.

The vendor-assigned CVSS 3.1 score of 6.8 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N accurately reflects the risk profile. AC:H is justified by four simultaneous preconditions that must all hold: multiple OAuth/OIDC providers configured, account linking while authenticated enabled, at least one provider's authorization flow observable by the attacker, and at least one target provider not enforcing PKCE. UI:R correctly captures that the victim must be socially engineered into initiating a legitimate OAuth flow - pure CSRF is explicitly insufficient per the advisory. The high C and I scores reflect the real-world consequence: a successful attack yields durable account takeover via a persistently linked provider credential, a severe impact. No EPSS data was provided in the input, and the vulnerability is not listed in CISA KEV, indicating no confirmed mass exploitation at time of analysis. The high complexity requirements substantially reduce practical exploitation likelihood compared to what the base CVSS severity alone implies, making this a high-priority patch specifically for multi-provider deployments with account linking enabled, but a lower operational priority for single-provider applications or those without the linking feature.

An attacker targeting a multi-provider Next.js application with account linking identifies that one configured provider (e.g., GitHub) does not enforce PKCE. The attacker lures the authenticated victim into clicking a link that initiates a legitimate GitHub OAuth flow in the victim's browser, generating a state cookie scoped globally - not to GitHub. Before the victim completes the GitHub flow, the attacker manipulates the redirect so the callback is processed by a second provider (e.g., Google), which accepts the GitHub-minted state cookie due to the absent provider binding. This causes the attacker's pre-authorized Google account to be linked to the victim's Auth.js user, granting the attacker persistent sign-in to the victim's account via the linked Google credential. No public exploit code has been identified at time of analysis.