nextauthjs

Records14All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

nextauthjs records in CISA KEV

No nextauthjs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Next-auth 9 records MEDIUM

Records

9 records in Next-auth · all components

TI-2022-13171 CVE-2022-31127 · GHSA-pgjx-7f9g-9463

Improper handling of email input in next-auth

MEDIUM 64

NextAuth.js is a complete open source authentication solution for Next.js applications.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01132 Published 2022-07-06 Fixed in 3.29.8, 4.9.0 CWE-79

TI-2022-16351 CVE-2022-35924 · GHSA-xv97-c62v-4587

Verification requests (magic link) sent to unwanted emails

MEDIUM 50

NextAuth.js is a complete open source authentication solution for Next.js applications.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01471 Published 2022-08-02 Fixed in 4.10.3, 3.29.10 CWE-20

TI-2022-13137 CVE-2022-31093 · GHSA-g5fm-jp9v-2432

Improper Handling of `callbackUrl` parameter in next-auth

MEDIUM 42

NextAuth.js is a complete open source authentication solution for Next.js applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01748 Published 2022-06-27 Fixed in 3.29.5, 4.5.0 CWE-754

TI-2023-12218 CVE-2023-27490 · GHSA-7r7x-4c4q-c4qf

Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth

MEDIUM 41

NextAuth.js is an open source authentication solution for Next.js applications.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00538 Published 2023-03-09 Fixed in 4.20.1 CWE-352

TI-2022-18639 CVE-2022-39263 · GHSA-4rxr-27mm-mxq9

NextAuth.js Upstash Adapter missing token verification

LOW 38

`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00721 Published 2022-09-28 Fixed in 3.0.2 CWE-287

TI-2023-26172 CVE-2023-48309 · GHSA-v64w-49xw-qq89

next-auth vulnerable to possible user mocking that bypasses basic authentication

LOW 31

NextAuth.js provides authentication for Next.js.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.007 Published 2023-11-20 Fixed in 4.24.5 CWE-285

TI-2021-04410 CVE-2021-21310 · GHSA-pg53-56cg-4m8q

Token verification bug in next-auth

LOW 31

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01688 Published 2021-02-11 Fixed in 3.3.0 CWE-290

TI-2022-08669 CVE-2022-24858 · GHSA-f9wg-5f46-cjmw

Default redirect callback vulnerable to open redirects

LOW 29

next-auth v3 users before version 3.29.2 are impacted.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0079 Published 2022-04-19 Fixed in 3.29.2, 4.3.2 CWE-290

TI-2022-11757 CVE-2022-29214 · GHSA-q2mx-j4x2-2h74

URL Redirection to Untrusted Site ('Open Redirect') in next-auth

LOW 28

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0067 Published 2022-05-20 Fixed in 3.29.3, 4.3.3 CWE-601

Open these records in search →