Nextauth.js vulnerabilities

Products

• Next-auth 9

Newest

• nextauth.js next-auth next-auth vulnerable to possible user mocking that bypasses basic authentication CVE-2023-48309 Fix available 5.3 MediumNovember 20, 2023
• nextauth.js next-auth Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth CVE-2023-27490 Fix available 8.1 HighMarch 9, 2023
• nextauth.js next-auth NextAuth.js Upstash Adapter missing token verification CVE-2022-39263 Fix available 6.8 MediumSeptember 28, 2022
• nextauth.js next-auth Verification requests (magic link) sent to unwanted emails CVE-2022-35924 Fix available 9.1 CriticalAugust 2, 2022
• nextauth.js next-auth Improper handling of email input in next-auth CVE-2022-31127 Fix available 7.1 HighJuly 6, 2022
• nextauth.js next-auth Improper Handling of `callbackUrl` parameter in next-auth CVE-2022-31093 Fix available 7.5 HighJune 21, 2022
• nextauth.js next-auth URL Redirection to Untrusted Site ('Open Redirect') in next-auth CVE-2022-29214 Fix available 6.1 MediumMay 20, 2022
• nextauth.js next-auth Default redirect callback vulnerable to open redirects CVE-2022-24858 Fix available 6.1 MediumApril 19, 2022
• nextauth.js next-auth Token verification bug in next-auth CVE-2021-21310 Fix available 6.1 MediumFebruary 11, 2021