@chirpy-dev/analytics (0.0.1), @chirpy-dev/main-app (>=0.1.0, <=0.3.0) +16 more potentially affected by CVE-2023-27490 via next-auth (>=4.0.0-beta.6, <=4.19.2)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.9, =4.0.0-alpha.11, =4.0.0-alpha.1, =4.0.0-alpha.6, =0.31.1, =1.42.1, =0.50.4, =0.1.0, =0.3.0, =1.0.0-beta.1, =1.0.0-beta.31, =2.3.0-beta.7, =2.4.0-beta.16 and more Source cves: CVE-2023-27490 Source advisory: OSV:GHSA-7R7X-4C4Q-C4QF...

CVE-2023-27490 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth

NextAuth.js is an open source authentication solution for Next.js applications. next-auth applications using OAuth provider versions before v4.20.1 have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social...