Email Address Parsing Vulnerability

next-auth is vulnerable to email address parsing vulnerability. The vulnerability is due to an incorrect address parsing behavior in Nodemailer, which allows an attacker to craft a malicious email input that redirects authentication or verification emails to an attacker-controlled mailbox instead...

Exploit for CVE-2026-23478

🔐 CVE-2026-23478 — Critical Authentication Bypass !Critical...

CVE-2026-23478

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update. This vulnerability is fixed in...

CVE-2026-23478

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update. This vulnerability is fixed in...

CVE-2026-23478 Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update. This vulnerability is fixed in...

PT-2026-2806

Name of the Vulnerable Software and Affected Versions Cal.com versions 3.1.6 through 6.0.6 Description Cal.com, an open-source scheduling software, has a critical flaw in a custom NextAuth JWT callback. This issue allows attackers to gain full authenticated access to any user's account by supplyi...

Cal.com 安全漏洞

Cal.com is an open source scheduling software from Cal.com Open Source. A security vulnerability exists in Cal.com versions 3.1.6 through prior to 6.0.7, which stems from a flaw in the custom NextAuth JWT callback that could allow an attacker to gain full authentication access to any user account...

@chirpy-dev/analytics (=0.0.1), @chirpy-dev/ui (=0.0.1) +39 more potentially affected by unknown CVE via next-auth (>=4.0.0-beta.6 <=4.24.11)

next-auth NPM version =4.0.0-beta.6, =1.9.0, =0.1.0-0, =0.0.2, =1.0.0, =1.0.0, =4.0.0-alpha.24, =0.0.0-experimental-20260318092212, =0.0.0-experimental-20260318092212, =0.6.1, =0.0.0-0d361a26c, =1.11.1-ee257e05.17 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-13744118...

CVE-2022-39263

@next-auth/upstash-redis-adapter is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use next-auth Email Provider and @next-auth/upstash-redis-adapter before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation...

@5minds/processcube_docflow (>=1.3.2-develop-01bdfb-m4jp5iuo <=2.1.0-test-fb53a9-mispuplg), @adamjoelfraser/auth-drizzle (=1.0.0) +510 more potentially affected by CVE-2023-48309 via next-auth (>=0.0.0-manual.83c4ebd1 <=4.24.4)

next-auth NPM version =0.0.0-manual.83c4ebd1, =1.3.2-develop-01bdfb-m4jp5iuo, =0.1.20, =3.0.5, =3.0.3, =1.1.18, =1.1.63, =1.1.7, =1.0.77, =1.0.1, =0.1.0, =1.1.77 and more Source cves: CVE-2023-48309 Source advisory: OSV:GHSA-V64W-49XW-QQ89...

next-auth security vulnerability

next-auth is the complete open source authentication solution for Next.js applications. A security vulnerability exists in versions of next-auth prior to 4.24.5, which stems from an attacker being able to obtain a NextAuth.js-issued JWT from an interrupted OAuth login process status, PKCE, or...

CVE-2022-31186

Summary of CVE-2022-31186 : A information-disclosure vulnerability affects NextAuth.js (Next.js authentication solution). The issue allows an attacker with log access to obtain sensitive data (e.g., an identity provider’s secret) that is inadvertently logged during OAuth error handling. This appl...

Improper Handling of `callbackUrl` parameter in next-auth

Impact An attacker can send a request to an app using NextAuth.js with an invalid callbackUrl query parameter, which internally we convert to a URL object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led t...

@5minds/processcube_docflow (>=1.3.2-develop-01bdfb-m4jp5iuo <=2.1.0-test-fb53a9-mispuplg), @adamjoelfraser/auth-drizzle (=1.0.0) +493 more potentially affected by CVE-2022-31093 via next-auth (>=4.10.3 <=4.3.4)

next-auth NPM version =4.10.3, =1.3.2-develop-01bdfb-m4jp5iuo, =0.1.20, =3.0.5, =3.0.3, =1.1.18, =1.1.63, =1.1.7, =1.0.77, =1.0.1, =0.1.0, =1.1.77 - @authjs-web3-providers/core =0.5.0 and more Source cves: CVE-2022-31093 Source advisory: OSV:GHSA-G5FM-JP9V-2432...

GHSA-PG53-56CG-4M8Q Token verification bug in next-auth

Impact Implementations using the Prisma database adapter with the Email provider are impacted. Implementations using the Prisma database adapter that are not using the Email provider are not impacted. Implementations using the default database adapter TypeORM with the Email provider are not...

NextAuth.js Security Vulnerability

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. A security vulnerability exists in NextAuth.js that stems from a token validation vulnerability...