Improper Handling of `callbackUrl` parameter in next-auth
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextauthjs | next-auth | before 3.29.5; 4.0.0 to before 4.5.0 | 3.29.5, 4.5.0 | Patch available | CNA |
| — | next-auth (npm) | before 3.29.5 | 3.29.5 | Patch available | GHSA-g5fm-jp9v-2432 |
| — | next-auth (npm) | 4.0.0 to before 4.5.0 | 4.5.0 | Patch available | GHSA-g5fm-jp9v-2432 |
- next-auth Vendornextauthjs Affected before 3.29.5; 4.0.0 to before 4.5.0 Fixed in 3.29.5, 4.5.0 Patch available CNA
- next-auth (npm) Vendor— Affected before 3.29.5 Fixed in 3.29.5 Patch available GHSA-g5fm-jp9v-2432
- next-auth (npm) Vendor— Affected 4.0.0 to before 4.5.0 Fixed in 4.5.0 Patch available GHSA-g5fm-jp9v-2432
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:node.js:*:* | 3.0.0 to before 3.29.5; 4.0.0 to before 4.5.0 | Vulnerable | nextauthjs |
- cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:node.js:*:* Versions 3.0.0 to before 3.29.5; 4.0.0 to before 4.5.0 Vulnerable ·nextauthjs
Remediation
- Fix · CNA next-auth (nextauthjs) Fixed in 3.29.5, 4.5.0
- Fix · GHSA-g5fm-jp9v-2432 next-auth (npm) Fixed in 3.29.5 Advisory →
- Fix · GHSA-g5fm-jp9v-2432 next-auth (npm) Fixed in 4.5.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31093
- 2026-10-03 Alias added: GHSA-g5fm-jp9v-2432
References
Patch 2
Advisory 3
More nextauthjs Next-auth vulnerabilities
- TI-2022-13171 Improper handling of email input in next-auth CVSS 3.1HIGH 7.1
- TI-2022-16351 Verification requests (magic link) sent to unwanted emails CVSS 3.1CRITICAL 9.1
- TI-2023-12218 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth CVSS 3.1HIGH 8.8
- TI-2022-18639 NextAuth.js Upstash Adapter missing token verification CVSS 3.1HIGH 8.1
- TI-2023-26172 next-auth vulnerable to possible user mocking that bypasses basic authentication CVSS 3.1MEDIUM 5.3
- TI-2021-04410 Token verification bug in next-auth CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-31093 · CVE Program
- CVE-2022-31093 · NVD
- FIRST EPSS
- GHSA-g5fm-jp9v-2432 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences