Authentication Bypass

2022-09-2903:31:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

58.6%

JSON

@next-auth/upstash-redis-adapter is vulnerable to authentication bypass. The vulnerability exists because the createVerificationToken function of index.ts does not properly check the token during the email verification, allowing an attacker to get information about the verification token’s expired duration

CPENameOperatorVersion
@next-auth/upstash-redis-adapterle3.0.1
@next-auth/upstash-redis-adapterle3.0.1

CPE	Name	Operator	Version
	@next-auth/upstash-redis-adapter	le	3.0.1
	@next-auth/upstash-redis-adapter	le	3.0.1

References

github.com/nextauthjs/next-auth/commit/d16e04848ee703cf797724194d4ad2907fe125a9

github.com/nextauthjs/next-auth/pull/5377

github.com/nextauthjs/next-auth/security/advisories/GHSA-4rxr-27mm-mxq9

0.002 Low

EPSS

Percentile

58.6%

JSON

Related for VERACODE:37320