CVE-2022-31093
In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.66%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.66% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-754
- Affected
- nextauth.js/next-auth
- Source
- security-advisories@github.com
References
- https://github.com/nextauthjs/next-auth/commit/25517b73153332d948114bacdff3b5908de91d85Patch, Third Party Advisory
- https://github.com/nextauthjs/next-auth/commit/e498483b23273d1bfc81be68339607f88d411bd6Patch, Third Party Advisory
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-g5fm-jp9v-2432Mitigation, Third Party Advisory
- https://next-auth.js.org/configuration/initialization#advanced-initializationVendor Advisory
- https://github.com/nextauthjs/next-auth/commit/25517b73153332d948114bacdff3b5908de91d85Patch, Third Party Advisory
- https://github.com/nextauthjs/next-auth/commit/e498483b23273d1bfc81be68339607f88d411bd6Patch, Third Party Advisory
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-g5fm-jp9v-2432Mitigation, Third Party Advisory
- https://next-auth.js.org/configuration/initialization#advanced-initializationVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.