EUVD-2026-57601
GHSA-x445-f3h2-j279
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
AC:H for four simultaneous preconditions; UI:R because victim must actively initiate the OAuth flow; PR:N as the attacker needs no application credentials; C:H/I:H for durable account takeover via persistent provider linkage; A:N for no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
4Blast Radius
ecosystem impact- 237 npm packages depend on @auth/core (59 direct, 180 indirect)
Ecosystem-wide dependent count for version 0.41.3.
DescriptionCVE.org
NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
AnalysisAI
Provider-confusion in NextAuth.js (next-auth and @auth/core) allows an attacker to link their own OAuth identity at a target provider to a victim's Auth.js user account, granting the attacker persistent unauthorized sign-in. The flaw stems from OAuth anti-CSRF cookies - state, nonce, and PKCE verifier - being stored globally without binding to the originating provider, so a callback for one provider can consume check values minted during a flow initiated with a different provider. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of the following conditions to hold simultaneously: the application configures multiple OAuth/OIDC providers; authenticated users are permitted to link additional providers via Auth.js account-linking; at least one configured provider's authorization request is observable by the attacker (e.g., a well-known or attacker-influenced authorization server endpoint or redirect URI); and at least one target provider's callback can be satisfied using only the state or nonce cookie without a PKCE verifier, meaning that provider does not mandate PKCE on the relying party. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 6.8 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N accurately reflects the risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a multi-provider Next.js application with account linking identifies that one configured provider (e.g., GitHub) does not enforce PKCE. The attacker lures the authenticated victim into clicking a link that initiates a legitimate GitHub OAuth flow in the victim's browser, generating a state cookie scoped globally - not to GitHub. … |
| Remediation | Vendor-released patches are available: upgrade to @auth/core 0.41.3 (https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3), next-auth 4.24.15 (https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15), or next-auth 5.0.0-beta.32 (https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
NextAuth.js is an open source authentication solution for Next.js applications. Rated high severity (CVSS 8.8), this vul
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated medium severity (CVSS 6.1)
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Rated medium severity (CVSS
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated critical severity (CVSS 9.
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.
Denial of service in NextAuth.js's getToken() helper allows unauthenticated remote attackers to crash any API route, mid
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated high severity (CVSS 7.5),
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Rated medium severity (CVSS
next-auth v3 users before version 3.29.2 are impacted. Rated medium severity (CVSS 6.1), this vulnerability is remotely
NextAuth.js provides authentication for Next.js. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploi
Share
External POC / Exploit Code
Leaving vuln.today