{"id":"CVE-2022-31186","aliases":["EUVD-2022-6592","GHSA-p6mm-27gq-9v3p"],"status":"published","title":"Leakage of excessive information into log in next-auth","description":"NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00256,"percentile":0.17436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2022-08-01T19:25:24Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"npm","package":"next-auth","fixed_in":["3.29.9","4.10.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next-auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next-auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.10.2"}]}]},{"source":"osv","ecosystem":"npm","package":"next-auth","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.29.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next-auth","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.10.2"}]}]}],"products":[{"vendor":"next-auth","product":"nextauth.js"},{"vendor":"nextauthjs","product":"next-auth"}],"references":[{"url":"https://next-auth.js.org/getting-started/upgrade-v4","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://github.com/nextauthjs/next-auth/security/advisories/GHSA-p6mm-27gq-9v3p","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://next-auth.js.org/configuration/options#logger","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://next-auth.js.org/warnings#debug_enabled","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31186","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p6mm-27gq-9v3p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31186.json","tags":["advisory"]},{"url":"https://github.com/nextauthjs/next-auth","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-31186","title":"Leakage of excessive information into log in next-auth","description":"NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.","status":"published","published":"2022-08-01T19:25:24Z","modified":"2025-04-23T17:56:16.785Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:34:35.615708Z"}],"euvd":[{"id":"EUVD-2022-6592","description":"NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.","status":"published","published":"2022-08-01T19:25:24Z","modified":"2025-04-23T17:56:16Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:52:09.919052Z"}],"ghsa":[{"id":"GHSA-p6mm-27gq-9v3p","title":"next-auth before v4.10.2 and v3.29.9 leaks excessive information into log","description":"### Impact\nAn information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions.\n\n### Patches\nWe patched this vulnerability in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production and documented it [here](https://next-auth.js.org/warnings#debug_enabled).\n\u003e You have enabled the debug option. It is meant for development only, to help you catch issues in your authentication flow and you should consider removing this option when deploying to production. One way of only allowing debugging while not in production is to set debug: process.env.NODE_ENV !== \"production\", so you can commit this without needing to change the value.\n\u003e \n\u003e If you want to log debug messages during production anyway, we recommend setting the [logger option](https://next-auth.js.org/configuration/options#logger) with proper sanitization of potentially sensitive user information.\n\nTo upgrade:\n\n```sh\nnpm i next-auth@latest\n# or\nyarn add next-auth@latest\n# or\npnpm add next-auth@latest\n```\n(This will update to the latest v4 version, but you can change `latest` to 3 if you want to stay on v3. This is not recommended. v3 is unmaintained.)\n\n### Workarounds\n\nIf for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs:\n```ts\n// Example\nimport log from \"your-logging-service\"\nexport const authOptions: NextAuthOptions = {\n  debug: process.env.NODE_ENV !== \"production\",\n  logger: {\n    error: (code, metadata) =\u003e {\n      if (!(metadata instanceof Error) \u0026\u0026  metadata.provider) {\n        // redact the provider secret here\n        delete metadata.provider\n        log.error(code, metadata)\n      } else {\n        log.error(code, metadata)\n      }\n    }\n  },\n}\n```\n\n### References\nRelated documentation:\n- https://next-auth.js.org/warnings#debug_enabled\n- https://next-auth.js.org/configuration/options#logger \n- https://next-auth.js.org/getting-started/upgrade-v4\n\n### For more information\nIf you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability\n\n### Timeline\nThe issue was reported 18th of July, a response was sent out in less than 20 minutes and after identifying the issue a patch was published within a week.","status":"published","published":"2022-08-06T05:29:45Z","modified":"2023-01-27T05:07:15Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:36:21.8171Z"}],"nvd":[{"id":"CVE-2022-31186","description":"NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.","status":"published","published":"2022-08-01T20:15:08.583Z","modified":"2026-06-17T04:44:59.163Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"CVE-2022-31186","title":"Leakage of excessive information into log in next-auth","description":"NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.","status":"published","published":"2022-08-01T19:25:24Z","modified":"2026-10-28T02:30:33.017977989Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"GHSA-p6mm-27gq-9v3p","title":"next-auth before v4.10.2 and v3.29.9 leaks excessive information into log","description":"### Impact\nAn information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions.\n\n### Patches\nWe patched this vulnerability in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production and documented it [here](https://next-auth.js.org/warnings#debug_enabled).\n\u003e You have enabled the debug option. It is meant for development only, to help you catch issues in your authentication flow and you should consider removing this option when deploying to production. One way of only allowing debugging while not in production is to set debug: process.env.NODE_ENV !== \"production\", so you can commit this without needing to change the value.\n\u003e \n\u003e If you want to log debug messages during production anyway, we recommend setting the [logger option](https://next-auth.js.org/configuration/options#logger) with proper sanitization of potentially sensitive user information.\n\nTo upgrade:\n\n```sh\nnpm i next-auth@latest\n# or\nyarn add next-auth@latest\n# or\npnpm add next-auth@latest\n```\n(This will update to the latest v4 version, but you can change `latest` to 3 if you want to stay on v3. This is not recommended. v3 is unmaintained.)\n\n### Workarounds\n\nIf for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs:\n```ts\n// Example\nimport log from \"your-logging-service\"\nexport const authOptions: NextAuthOptions = {\n  debug: process.env.NODE_ENV !== \"production\",\n  logger: {\n    error: (code, metadata) =\u003e {\n      if (!(metadata instanceof Error) \u0026\u0026  metadata.provider) {\n        // redact the provider secret here\n        delete metadata.provider\n        log.error(code, metadata)\n      } else {\n        log.error(code, metadata)\n      }\n    }\n  },\n}\n```\n\n### References\nRelated documentation:\n- https://next-auth.js.org/warnings#debug_enabled\n- https://next-auth.js.org/configuration/options#logger \n- https://next-auth.js.org/getting-started/upgrade-v4\n\n### For more information\nIf you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability\n\n### Timeline\nThe issue was reported 18th of July, a response was sent out in less than 20 minutes and after identifying the issue a patch was published within a week.","status":"published","published":"2022-08-06T05:29:45Z","modified":"2023-11-08T04:09:29.321869Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:52.891208Z"}]}}