Vulnerability · Published Apr 19, 2022 · Assigned by GitHub_M

CVE-2022-24858Default redirect callback vulnerable to open redirects

Medium 6.1

In plain English

A medium-severity authentication bypass by spoofing in next-auth from nextauthjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.8%top 43.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	next-auth	3.29.2	GHSA-f9wg-5f46-cjmw
npm	next-auth	4.3.2	GHSA-f9wg-5f46-cjmw

Affected products (as reported)

Vendor	Product	Versions
nextauthjs	next-auth	< 3.29.2, < 4.3.2

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

References

https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw x_refsource_CONFIRM
https://next-auth.js.org/configuration/callbacks#redirect-callback x_refsource_MISC
https://next-auth.js.org/getting-started/upgrade-v4 x_refsource_MISC