Read the docs
TI-2022-13226 Aliases CVE-2022-31186GHSA-p6mm-27gq-9v3p

Leakage of excessive information into log in next-auth

Priority LOW 16CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-08
Fix Fixed next-auth (nextauthjs): 4.10.2, 3.29.9next-auth (npm): 3.29.9, 4.10.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextauthjsnext-auth4.0.0 to before 4.10.2; before 3.29.94.10.2, 3.29.9Patch availableCNA
—next-auth (npm)before 3.29.93.29.9Patch availableGHSA-p6mm-27gq-9v3p
—next-auth (npm)4.0.0 to before 4.10.24.10.2Patch availableGHSA-p6mm-27gq-9v3p
  • next-auth Vendornextauthjs Affected 4.0.0 to before 4.10.2; before 3.29.9 Fixed in 4.10.2, 3.29.9 Patch available CNA
  • next-auth (npm) Vendor— Affected before 3.29.9 Fixed in 3.29.9 Patch available GHSA-p6mm-27gq-9v3p
  • next-auth (npm) Vendor— Affected 4.0.0 to before 4.10.2 Fixed in 4.10.2 Patch available GHSA-p6mm-27gq-9v3p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:next-auth:nextauth.js:*:*:*:*:*:node.js:*:*before 3.29.9; 4.0.0 to before 4.10.2VulnerableNext-auth
  • cpe:2.3:a:next-auth:nextauth.js:*:*:*:*:*:node.js:*:* Versions before 3.29.9; 4.0.0 to before 4.10.2 Vulnerable ·Next-auth

Remediation

  • Fix · CNA next-auth (nextauthjs) Fixed in 4.10.2, 3.29.9
  • Fix · GHSA-p6mm-27gq-9v3p next-auth (npm) Fixed in 3.29.9 Advisory →
  • Fix · GHSA-p6mm-27gq-9v3p next-auth (npm) Fixed in 4.10.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31186
  2. 2026-10-03 Alias added: GHSA-p6mm-27gq-9v3p

References

Advisory 5

Other 1

  • TI-2022-13171 Improper handling of email input in next-auth CVSS 3.1HIGH 7.1
  • TI-2022-16351 Verification requests (magic link) sent to unwanted emails CVSS 3.1CRITICAL 9.1
  • TI-2026-51538 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass CVSS 4.0CRITICAL 9.1
  • TI-2026-51539 Improper authorization in nextauthjs next-auth CVSS 4.0CRITICAL 9.1
  • TI-2022-13137 Improper Handling of `callbackUrl` parameter in next-auth CVSS 3.1HIGH 7.5
  • TI-2023-12218 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth CVSS 3.1HIGH 8.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences