Open Redirect

2022-04-2103:03:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

42.4%

JSON

next-auth is vulnerable to open redirect. The vulnerability exists in redirect function in default-callbacks.ts due to the lack of url validation which allows an attacker to parse malicious urls to redirect the user.

CPENameOperatorVersion
next-authle3.2.0-canary.17
next-authle3.2.0-canary.8
next-authle3.29.1
next-authle4.3.1
next-authle3.2.0-canary.17
next-authle3.2.0-canary.8
next-authle3.29.1
next-authle4.3.1

Name	Operator	Version
next-auth	le	3.2.0-canary.17
next-auth	le	3.2.0-canary.8
next-auth	le	3.29.1
next-auth	le	4.3.1
next-auth	le	3.2.0-canary.17
next-auth	le	3.2.0-canary.8
next-auth	le	3.29.1
next-auth	le	4.3.1