Auth
Monthly
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account and its valid bearer token to read, create, update, delete, and manage media on a victim site without any victim account or interaction. The flaw affects @tinacms/auth before 1.1.4 and the next-tinacms-azure adapter before 15.0.1, where the server-side isAuthorized helper trusts a request-supplied clientID and therefore validates the attacker's token against the attacker's own TinaCloud app rather than the site's configured app (CWE-639, CVSS 8.8, PR:L). Exploitation is authenticated from the attacker's perspective - the attacker must already control a TinaCloud-verifiable token, so any TinaCloud account suffices - while no public exploit code was identified at time of analysis and the vendor has released patched versions.
Denial of service in NextAuth.js's getToken() helper allows unauthenticated remote attackers to crash any API route, middleware, or server-side handler that calls getToken() directly by sending a single HTTP request with a malformed Authorization: Bearer header containing invalid percent-encoding. The vulnerability affects next-auth 4.0.6-4.24.14, next-auth 5.0.0-beta.0-5.0.0-beta.31, and @auth/core 0.1.0-0.41.2, and is fixed in next-auth 4.24.15, next-auth 5.0.0-beta.32, and @auth/core 0.41.3. No public exploit code has been identified at time of analysis, but the trigger condition is trivially constructible from the public advisory description alone.
Provider-confusion in NextAuth.js (next-auth and @auth/core) allows an attacker to link their own OAuth identity at a target provider to a victim's Auth.js user account, granting the attacker persistent unauthorized sign-in. The flaw stems from OAuth anti-CSRF cookies - state, nonce, and PKCE verifier - being stored globally without binding to the originating provider, so a callback for one provider can consume check values minted during a flow initiated with a different provider. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 6.8 score with C:H/I:H reflects a full account-takeover outcome when the required multi-condition setup is present.
Supabase Auth allows remote attackers to hijack user sessions by crafting fraudulent ID tokens when Apple or Azure OAuth providers are configured, enabling unauthorized access to victim accounts without requiring user interaction. An attacker can forge a valid JWT token for any target email address and exchange it at the token endpoint to obtain legitimate session credentials, effectively impersonating arbitrary users. This affects organizations using Supabase with Apple or Azure authentication enabled, with no patch currently available to remediate the vulnerability.
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account and its valid bearer token to read, create, update, delete, and manage media on a victim site without any victim account or interaction. The flaw affects @tinacms/auth before 1.1.4 and the next-tinacms-azure adapter before 15.0.1, where the server-side isAuthorized helper trusts a request-supplied clientID and therefore validates the attacker's token against the attacker's own TinaCloud app rather than the site's configured app (CWE-639, CVSS 8.8, PR:L). Exploitation is authenticated from the attacker's perspective - the attacker must already control a TinaCloud-verifiable token, so any TinaCloud account suffices - while no public exploit code was identified at time of analysis and the vendor has released patched versions.
Denial of service in NextAuth.js's getToken() helper allows unauthenticated remote attackers to crash any API route, middleware, or server-side handler that calls getToken() directly by sending a single HTTP request with a malformed Authorization: Bearer header containing invalid percent-encoding. The vulnerability affects next-auth 4.0.6-4.24.14, next-auth 5.0.0-beta.0-5.0.0-beta.31, and @auth/core 0.1.0-0.41.2, and is fixed in next-auth 4.24.15, next-auth 5.0.0-beta.32, and @auth/core 0.41.3. No public exploit code has been identified at time of analysis, but the trigger condition is trivially constructible from the public advisory description alone.
Provider-confusion in NextAuth.js (next-auth and @auth/core) allows an attacker to link their own OAuth identity at a target provider to a victim's Auth.js user account, granting the attacker persistent unauthorized sign-in. The flaw stems from OAuth anti-CSRF cookies - state, nonce, and PKCE verifier - being stored globally without binding to the originating provider, so a callback for one provider can consume check values minted during a flow initiated with a different provider. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 6.8 score with C:H/I:H reflects a full account-takeover outcome when the required multi-condition setup is present.
Supabase Auth allows remote attackers to hijack user sessions by crafting fraudulent ID tokens when Apple or Azure OAuth providers are configured, enabling unauthorized access to victim accounts without requiring user interaction. An attacker can forge a valid JWT token for any target email address and exchange it at the token endpoint to obtain legitimate session credentials, effectively impersonating arbitrary users. This affects organizations using Supabase with Apple or Azure authentication enabled, with no patch currently available to remediate the vulnerability.