Vulnerabilities

TI-2023-26172 CVE-2023-48309 · GHSA-v64w-49xw-qq89

next-auth vulnerable to possible user mocking that bypasses basic authentication

LOW 31

NextAuth.js provides authentication for Next.js.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.007 Published 2023-11-20 Fixed in 4.24.5 CWE-285

TI-2023-12218 CVE-2023-27490 · GHSA-7r7x-4c4q-c4qf

MEDIUM 41

NextAuth.js is an open source authentication solution for Next.js applications.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00538 Published 2023-03-09 Fixed in 4.20.1 CWE-352

TI-2022-18639 CVE-2022-39263 · GHSA-4rxr-27mm-mxq9

LOW 38

`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00721 Published 2022-09-28 Fixed in 3.0.2 CWE-287

TI-2022-16351 CVE-2022-35924 · GHSA-xv97-c62v-4587

MEDIUM 50

NextAuth.js is a complete open source authentication solution for Next.js applications.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01471 Published 2022-08-02 Fixed in 4.10.3, 3.29.10 CWE-20

TI-2022-13171 CVE-2022-31127 · GHSA-pgjx-7f9g-9463

MEDIUM 64

NextAuth.js is a complete open source authentication solution for Next.js applications.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01132 Published 2022-07-06 Fixed in 3.29.8, 4.9.0 CWE-79

TI-2022-13137 CVE-2022-31093 · GHSA-g5fm-jp9v-2432

MEDIUM 42

NextAuth.js is a complete open source authentication solution for Next.js applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01748 Published 2022-06-27 Fixed in 3.29.5, 4.5.0 CWE-754

TI-2022-11757 CVE-2022-29214 · GHSA-q2mx-j4x2-2h74

LOW 28

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0067 Published 2022-05-20 Fixed in 3.29.3, 4.3.3 CWE-601

TI-2022-08669 CVE-2022-24858 · GHSA-f9wg-5f46-cjmw

LOW 29

next-auth v3 users before version 3.29.2 are impacted.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0079 Published 2022-04-19 Fixed in 3.29.2, 4.3.2 CWE-290

TI-2021-04410 CVE-2021-21310 · GHSA-pg53-56cg-4m8q

LOW 31

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01688 Published 2021-02-11 Fixed in 3.3.0 CWE-290