PT-2022-16932

Name of the Vulnerable Software and Affected Versions next-auth versions 3.0.0 through 3.29.1 next-auth versions 4.0.0 through 4.3.1 Description The issue affects next-auth users, with versions 3 before 3.29.2 and version 4 before 4.3.2 being impacted. To resolve the issue, upgrading to version...

Token Verification Bug

Overview Impact next-auth implementations using the Prisma database adapter with the Email provider are impacted. Implementations using the Prisma database adapter that are not using the Email provider are not impacted. Implementations using the default database adapter TypeORM with the Email...

CVE-2021-21310

NextAuth.js (next-auth) token verification vulnerability affects the Prisma database adapter when used with the Email provider (before 3.3.0). The defect: verification tokens were checked but not the associated email identifier, enabling sign-in as another user with a valid token. The issue is sp...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2021-21310 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2021-21310 Source advisory: OSV:GHSA-PG53-56CG-4M8Q...