Next Auth
Monthly
Provider-confusion in NextAuth.js (next-auth and @auth/core) allows an attacker to link their own OAuth identity at a target provider to a victim's Auth.js user account, granting the attacker persistent unauthorized sign-in. The flaw stems from OAuth anti-CSRF cookies - state, nonce, and PKCE verifier - being stored globally without binding to the originating provider, so a callback for one provider can consume check values minted during a flow initiated with a different provider. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 6.8 score with C:H/I:H reflects a full account-takeover outcome when the required multi-condition setup is present.
Denial of service in NextAuth.js's getToken() helper allows unauthenticated remote attackers to crash any API route, middleware, or server-side handler that calls getToken() directly by sending a single HTTP request with a malformed Authorization: Bearer header containing invalid percent-encoding. The vulnerability affects next-auth 4.0.6-4.24.14, next-auth 5.0.0-beta.0-5.0.0-beta.31, and @auth/core 0.1.0-0.41.2, and is fixed in next-auth 4.24.15, next-auth 5.0.0-beta.32, and @auth/core 0.41.3. No public exploit code has been identified at time of analysis, but the trigger condition is trivially constructible from the public advisory description alone.
NextAuth.js provides authentication for Next.js. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NextAuth.js is an open source authentication solution for Next.js applications. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
next-auth v3 users before version 3.29.2 are impacted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Provider-confusion in NextAuth.js (next-auth and @auth/core) allows an attacker to link their own OAuth identity at a target provider to a victim's Auth.js user account, granting the attacker persistent unauthorized sign-in. The flaw stems from OAuth anti-CSRF cookies - state, nonce, and PKCE verifier - being stored globally without binding to the originating provider, so a callback for one provider can consume check values minted during a flow initiated with a different provider. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 6.8 score with C:H/I:H reflects a full account-takeover outcome when the required multi-condition setup is present.
Denial of service in NextAuth.js's getToken() helper allows unauthenticated remote attackers to crash any API route, middleware, or server-side handler that calls getToken() directly by sending a single HTTP request with a malformed Authorization: Bearer header containing invalid percent-encoding. The vulnerability affects next-auth 4.0.6-4.24.14, next-auth 5.0.0-beta.0-5.0.0-beta.31, and @auth/core 0.1.0-0.41.2, and is fixed in next-auth 4.24.15, next-auth 5.0.0-beta.32, and @auth/core 0.41.3. No public exploit code has been identified at time of analysis, but the trigger condition is trivially constructible from the public advisory description alone.
NextAuth.js provides authentication for Next.js. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NextAuth.js is an open source authentication solution for Next.js applications. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
next-auth v3 users before version 3.29.2 are impacted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.