TI-2022-18639 Aliases CVE-2022-39263 GHSA-4rxr-27mm-mxq9

NextAuth.js Upstash Adapter missing token verification

LOW 38CWE-287Published 2022-09-28 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. The vulnerability is patched in v3.0.2. A workaround is available. Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00721 54th percentileScored 2026-11-07

Fix Fixed next-auth (nextauthjs): 3.0.2@next-auth/upstash-redis-adapter (npm): 3.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nextauthjs	next-auth	before 3.0.2	3.0.2	Patch available	CNA
—	@next-auth/upstash-redis-adapter (npm)	before 3.0.2	3.0.2	Patch available	GHSA-4rxr-27mm-mxq9

next-auth Vendornextauthjs Affected before 3.0.2 Fixed in 3.0.2 Patch available CNA
@next-auth/upstash-redis-adapter (npm) Vendor— Affected before 3.0.2 Fixed in 3.0.2 Patch available GHSA-4rxr-27mm-mxq9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nextauth.js:next-auth::::::node.js::*	before 3.0.2	Vulnerable	nextauthjs

cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:node.js:*:* Versions before 3.0.2 Vulnerable ·nextauthjs

Remediation

Fix · CNA next-auth (nextauthjs) Fixed in 3.0.2
Fix · GHSA-4rxr-27mm-mxq9 @next-auth/upstash-redis-adapter (npm) Fixed in 3.0.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-39263
2026-10-03 Alias added: GHSA-4rxr-27mm-mxq9

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-39263

Other 1

https://github.com/nextauthjs/next-auth

TI-2022-13171 Improper handling of email input in next-auth CVSS 3.1HIGH 7.1
TI-2022-16351 Verification requests (magic link) sent to unwanted emails CVSS 3.1CRITICAL 9.1
TI-2022-13137 Improper Handling of `callbackUrl` parameter in next-auth CVSS 3.1HIGH 7.5
TI-2023-12218 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth CVSS 3.1HIGH 8.8
TI-2023-26172 next-auth vulnerable to possible user mocking that bypasses basic authentication CVSS 3.1MEDIUM 5.3
TI-2021-04410 Token verification bug in next-auth CVSS 3.1MEDIUM 6.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences