Vulnerabilities

TI-2026-51539 CVE-2026-73421 · GHSA-8fpg-xm3f-6cx3

Improper authorization in nextauthjs next-auth

MEDIUM 46

NextAuth.js provides authentication for Next.js.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00643 Published 2026-08-13 Fixed in 5.0.0-beta.32 CWE-285

TI-2026-51538 CVE-2026-73420 · GHSA-7rqj-j65f-68wh

NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

MEDIUM 48

NextAuth.js provides authentication for Next.js.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00725 Published 2026-08-13 Fixed in 4.24.15, 5.0.0-beta.32 +1 CWE-180

TI-2026-51537 CVE-2026-73419 · GHSA-x445-f3h2-j279

NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

LOW 32

NextAuth.js provides authentication for Next.js.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00249 Published 2026-08-12 Fixed in 4.24.15, 5.0.0-beta.32 +1 CWE-345

TI-2026-51536 CVE-2026-73418 · GHSA-xmf8-cvqr-rfgj

NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

MEDIUM 40

NextAuth.js provides authentication for Next.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00877 Published 2026-08-12 Fixed in 0.41.3, 5.0.0-beta.32 +1 CWE-20

TI-2023-26172 CVE-2023-48309 · GHSA-v64w-49xw-qq89

next-auth vulnerable to possible user mocking that bypasses basic authentication

LOW 31

NextAuth.js provides authentication for Next.js.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.007 Published 2023-11-20 Fixed in 4.24.5 CWE-285

TI-2023-12218 CVE-2023-27490 · GHSA-7r7x-4c4q-c4qf

Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth

MEDIUM 41

NextAuth.js is an open source authentication solution for Next.js applications.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00538 Published 2023-03-09 Fixed in 4.20.1 CWE-352

TI-2022-18639 CVE-2022-39263 · GHSA-4rxr-27mm-mxq9

NextAuth.js Upstash Adapter missing token verification

LOW 38

`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00721 Published 2022-09-28 Fixed in 3.0.2 CWE-287

TI-2022-16351 CVE-2022-35924 · GHSA-xv97-c62v-4587

Verification requests (magic link) sent to unwanted emails

MEDIUM 50

NextAuth.js is a complete open source authentication solution for Next.js applications.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01471 Published 2022-08-02 Fixed in 4.10.3, 3.29.10 CWE-20

TI-2022-13226 CVE-2022-31186 · GHSA-p6mm-27gq-9v3p

Leakage of excessive information into log in next-auth

LOW 16

NextAuth.js is a complete open source authentication solution for Next.js applications.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00256 Published 2022-08-01 Fixed in 4.10.2, 3.29.9 CWE-532

TI-2022-13171 CVE-2022-31127 · GHSA-pgjx-7f9g-9463

Improper handling of email input in next-auth

MEDIUM 64

NextAuth.js is a complete open source authentication solution for Next.js applications.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01132 Published 2022-07-06 Fixed in 3.29.8, 4.9.0 CWE-79

TI-2022-13137 CVE-2022-31093 · GHSA-g5fm-jp9v-2432

Improper Handling of `callbackUrl` parameter in next-auth

MEDIUM 42

NextAuth.js is a complete open source authentication solution for Next.js applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01748 Published 2022-06-27 Fixed in 3.29.5, 4.5.0 CWE-754

TI-2022-11757 CVE-2022-29214 · GHSA-q2mx-j4x2-2h74

URL Redirection to Untrusted Site ('Open Redirect') in next-auth

LOW 28

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0067 Published 2022-05-20 Fixed in 3.29.3, 4.3.3 CWE-601

TI-2022-08669 CVE-2022-24858 · GHSA-f9wg-5f46-cjmw

Default redirect callback vulnerable to open redirects

LOW 29

next-auth v3 users before version 3.29.2 are impacted.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0079 Published 2022-04-19 Fixed in 3.29.2, 4.3.2 CWE-290

TI-2021-04410 CVE-2021-21310 · GHSA-pg53-56cg-4m8q

Token verification bug in next-auth

LOW 31

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01688 Published 2021-02-11 Fixed in 3.3.0 CWE-290

Vulnerabilities

Filters