next-auth vulnerabilities (npm)
14 vulnerabilities.
-
next-authnpm NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) 9.1 Critical -
next-authnpm NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers 7.5 High -
next-authnpm NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass 9.1 Critical -
next-authnpm NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them 6.8 Medium -
next-authnpm NextAuthjs Email misdelivery Vulnerability 6.9 Medium -
next-authnpm next-auth vulnerable to possible user mocking that bypasses basic authentication 5.3 Medium -
next-authnpm Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth 8.1 High -
next-authnpm Verification requests (magic link) sent to unwanted emails 9.1 Critical -
next-authnpm Leakage of excessive information into log in next-auth 3.3 Low -
next-authnpm Improper handling of email input in next-auth 7.1 High -
next-authnpm Improper Handling of `callbackUrl` parameter in next-auth 7.5 High -
next-authnpm URL Redirection to Untrusted Site ('Open Redirect') in next-auth 6.1 Medium -
next-authnpm Default redirect callback vulnerable to open redirects 6.1 Medium -
next-authnpm Token verification bug in next-auth 6.1 Medium