MAL-2025-3794 Malicious code in next-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0038c51339b63eb3fe77a5d623ae004832f05cc831ff582362d202f30a49072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: next-auth-4.24.3.tgz is vulnerable to CVE-2023-48309 used in IBM Maximo Application Suite - Edge Data Collector

Summary IBM Maximo Application Suite - Edge Data Collector uses next-auth-4.24.3.tgz which is vulnerable to CVE-2023-48309 Vulnerability Details CVEID:CVE-2023-48309 DESCRIPTION: Auth.js next-auth could allow a remote attacker to obtain sensitive information, caused by improper authentication...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/main-app (>=0.1.0, <=0.3.0) +34 more potentially affected by CVE-2023-48309 via next-auth (>=4.0.0-beta.6, <=4.24.4)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.9, =0.1.0-0, =1.0.0, =1.0.0, =4.0.0-alpha.11, =4.0.0-alpha.1, =4.0.0-alpha.6, =0.6.1, =0.0.0-350929255, =1.11.1-ee257e05.17 and more Source cves: CVE-2023-48309 Source advisory: OSV:GHSA-V64W-49XW-QQ89...

GHSA-V64W-49XW-QQ89 Possible user mocking that bypasses basic authentication

Impact next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow state, PKCE or nonce. Manually overriding the...

Possible user mocking that bypasses basic authentication

Impact next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow state, PKCE or nonce. Manually overriding the...

CVE-2023-48309 next-auth vulnerable to possible user mocking that bypasses basic authentication

NextAuth.js provides authentication for Next.js. next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth...

Cross-Site Request Forgery (CSRF)

next-auth is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists due to the missing state, nonce, and PKCE checks for OAuth authentication, which allows an attacker to bypass the CSRF protection...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/main-app (>=0.1.0, <=0.3.0) +16 more potentially affected by CVE-2023-27490 via next-auth (>=4.0.0-beta.6, <=4.19.2)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.9, =4.0.0-alpha.11, =4.0.0-alpha.1, =4.0.0-alpha.6, =0.31.1, =1.42.1, =0.50.4, =0.1.0, =0.3.0, =1.0.0-beta.1, =1.0.0-beta.31, =2.3.0-beta.7, =2.4.0-beta.16 and more Source cves: CVE-2023-27490 Source advisory: OSV:GHSA-7R7X-4C4Q-C4QF...

Missing proper state, nonce and PKCE checks for OAuth authentication

Impact next-auth applications using OAuth provider versions before v4.20.1 are affected. A bad actor who can spy on the victim's network or able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim, bypassing...

GHSA-7R7X-4C4Q-C4QF Missing proper state, nonce and PKCE checks for OAuth authentication

Impact next-auth applications using OAuth provider versions before v4.20.1 are affected. A bad actor who can spy on the victim's network or able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim, bypassing...

Upstash Adapter missing token verification

Impact Applications that use next-auth Email Provider and @next-auth/upstash-redis-adapter before v3.0.2 are affected. Description The Upstash Redis adapter implementation did not check for both the identifier email and the token, but only checking for the identifier when verifying the token in t...

GHSA-4RXR-27MM-MXQ9 Upstash Adapter missing token verification

Impact Applications that use next-auth Email Provider and @next-auth/upstash-redis-adapter before v3.0.2 are affected. Description The Upstash Redis adapter implementation did not check for both the identifier email and the token, but only checking for the identifier when verifying the token in t...

next-auth before v4.10.2 and v3.29.9 leaks excessive information into log

Impact An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log which is thrown during OAuth error handling and use it to leverage further attacks o...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2022-31186 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2022-31186 Source advisory: OSV:GHSA-P6MM-27GQ-9V3P...

@chirpy-dev/main-app (>=0.1.0, <=0.3.0), @elastic/docsmobile (>=1.9.9, <=1.12.0) +7 more potentially affected by CVE-2022-31186 via next-auth (>=4.0.0-beta.6, <=4.9.0)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.9, =4.0.0-alpha.11, =4.0.0-alpha.1, =4.0.0-alpha.6, =0.31.1, =1.42.1, =0.50.4, =0.78.15-alpha.2 - chirpy-dev 0.1.0 Source cves: CVE-2022-31186 Source advisory: OSV:GHSA-P6MM-27GQ-9V3P...

GHSA-P6MM-27GQ-9V3P next-auth before v4.10.2 and v3.29.9 leaks excessive information into log

Impact An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log which is thrown during OAuth error handling and use it to leverage further attacks o...

Information Disclosure

next-auth is vulnerable to information disclosure. A local authenticated attacker is able to gain access to confidential information such as identity provider's classified data from the log through error handling of oAuthCallback function...

Authorization Bypass

next-auth is vulnerable to authorization bypass. The vulnerability exists because the email verification in email provider is not properly handled, allowing an attacker to bypass the mail address and log as a newly created user into the system...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2022-35924 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2022-35924 Source advisory: OSV:GHSA-XV97-C62V-4587...

GHSA-XV97-C62V-4587 NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails

Impact next-auth users who are using the EmailProvider either in versions before 4.10.3 or 3.29.10 are affected. If an attacker could forge a request that sent a comma-separated list of emails eg.: [email protected],[email protected] to the sign-in endpoint, NextAuth.js would send emails to...