CVE-2022-31127

🗓️ 06 Jul 2022 18:00:16Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 87 Views🌐 WEB

NextAuth.js CVE-2022-31127 email server phishing vulnerabilit

Reporter	Title	Published	Views	Family All 22
Circl	CVE-2022-31127	6 Jul 202222:14	–	circl
CNNVD	ZEIT Next.js, NextAuth.js – Cross-site Scripting vulnerabilities	6 Jul 202200:00	–	cnnvd
CNVD	ZEIT Next.js NextAuth.js Cross-Site Scripting Vulnerability	8 Jul 202200:00	–	cnvd
Cvelist	CVE-2022-31127 Improper handling of email input in next-auth	6 Jul 202218:00	–	cvelist
EUVD	EUVD-2022-6383	3 Oct 202520:07	–	euvd
Github Security Blog	Improper handling of email input	6 Jul 202219:27	–	github
Mend	CVE-2022-31127	6 Jul 202218:00	–	mend
NVD	CVE-2022-31127	6 Jul 202218:15	–	nvd
osv_cve	CVE-2022-31127 Improper handling of email input in next-auth	6 Jul 202218:00	–	osv_cve
osv_ghsa	GHSA-PGJX-7F9G-9463 Improper handling of email input	6 Jul 202219:27	–	osv_ghsa

NVD

Vulners

Node

nextauth.js next-authRange<3.29.8node.js

nextauth.js next-authRange4.0.0–4.9.0node.js

[
  {
    "product": "next-auth",
    "vendor": "nextauthjs",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.29.8"
      },
      {
        "status": "affected",
        "version": ">= 4.0.0, < 4.9.0"
      }
    ]
  }
]

Source	Link
next-auth	www.next-auth.js.org/providers/email
github	www.github.com/nextauthjs/next-auth/security/advisories/GHSA-pgjx-7f9g-9463
github	www.github.com/nextauthjs/next-auth/commit/ae834f1e08a4a9915665eecb9479c74c6b039c9c
next-auth	www.next-auth.js.org/getting-started/upgrade-v4
github	www.github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.9.0

Parameter	Position	Path	Description	CWE
email	request body	/api/auth/signin	The email parameter in the signin endpoint is not properly sanitized, allowing for HTML injection which can be used to perform phishing attacks via the email server.	CWE-79