Read the docs
TI-2021-04410 Aliases CVE-2021-21310GHSA-pg53-56cg-4m8q

Token verification bug in next-auth

Priority LOW 31CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.

Summary

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider are impacted. Implementations using the Email provider with the default database adapter are not impacted. Implementations using the Prisma database adapter but not using the Email provider are not impacted. The Prisma database adapter was checking the verification token, but was not verifying the email address associated with that token. This made it possible to use a valid token to sign in as another user when using the Prima adapter in conjunction with the Email provider. This issue is specific to the community supported Prisma adapter. This issue is fixed in version 3.3.0.

Why it matters now

EPSS 0.01688 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed next-auth (nextauthjs): 3.3.0next-auth (npm): 3.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextauthjsnext-authbefore 3.3.03.3.0Patch availableCNA
—next-auth (npm)before 3.3.03.3.0Patch availableGHSA-pg53-56cg-4m8q
  • next-auth Vendornextauthjs Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA
  • next-auth (npm) Vendor— Affected before 3.3.0 Fixed in 3.3.0 Patch available GHSA-pg53-56cg-4m8q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:node.js:*:*before 3.3.0Vulnerablenextauthjs
  • cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:node.js:*:* Versions before 3.3.0 Vulnerable ·nextauthjs

Remediation

  • Fix · CNA next-auth (nextauthjs) Fixed in 3.3.0
  • Fix · GHSA-pg53-56cg-4m8q next-auth (npm) Fixed in 3.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21310
  2. 2026-10-03 Alias added: GHSA-pg53-56cg-4m8q

References

Exploit 1

Advisory 3

  • TI-2022-13171 Improper handling of email input in next-auth CVSS 3.1HIGH 7.1
  • TI-2022-16351 Verification requests (magic link) sent to unwanted emails CVSS 3.1CRITICAL 9.1
  • TI-2022-13137 Improper Handling of `callbackUrl` parameter in next-auth CVSS 3.1HIGH 7.5
  • TI-2023-12218 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth CVSS 3.1HIGH 8.8
  • TI-2022-18639 NextAuth.js Upstash Adapter missing token verification CVSS 3.1HIGH 8.1
  • TI-2023-26172 next-auth vulnerable to possible user mocking that bypasses basic authentication CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences