Skip to content
OpenAdvisories

Package · npm

next-auth

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-73419

    NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

    NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that cr…

    nextauthjs @auth next-auth core npm
  • Medium —
    GHSA-5jpx-9hw9-2fx4

    NextAuthjs Email misdelivery Vulnerability

    ### Summary NextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in `nodemailer`'s address parser used by the project (fixed in `nodemailer` **v7.0.7**). A crafted input such as: ``` "e@atta…

    next-auth npm
  • Medium 5.3
    CVE-2023-48309

    next-auth vulnerable to possible user mocking that bypasses basic authentication

    NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-…

    nextauthjs next-auth next-auth npm
  • Medium 6.1
    CVE-2022-29214

    URL Redirection to Untrusted Site ('Open Redirect') in next-auth

    NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Prior to versions 3.29.3 and 4.3.3, an open redirect vulnerability is present when the developer is implementing an OAuth 1 provider. Versions 3.29.3 and 4.3.3 contain…

    nextauthjs next-auth next-auth npm
  • Medium 6.1
    CVE-2022-24858

    Default redirect callback vulnerable to open redirects

    next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to …

    nextauthjs next-auth next-auth npm
  • Medium 6.1
    CVE-2021-21310

    Token verification bug in next-auth

    NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider…

    nextauthjs next-auth next-auth npm