Log in Start free

Vulnerability · Published Mar 9, 2023 · Assigned by GitHub_M

CVE-2023-27490Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth

High 8.1

In plain English

A high-severity session fixation in next-auth from nextauthjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 54.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to **log in as the victim**, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmnext-auth4.20.1GHSA-7r7x-4c4q-c4qf

Affected products (as reported)

VendorProductVersions
nextauthjs next-auth < 4.20.1

Weakness: CWE-384, CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References