next-auth vulnerabilities

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Affected

>=5.0.0-beta.0 <5.0.0-beta.32

Fixed in

5.0.0-beta.32

Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

Affected

>=5.0.0-beta.0 <5.0.0-beta.32 · >=4.0.6 <4.24.15

Fixed in

4.24.15, 5.0.0-beta.32

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Affected

>=4.10.3 <4.24.15 · >=5.0.0-beta.1 <5.0.0-beta.32

Fixed in

4.24.15, 5.0.0-beta.32

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

Affected

>=5.0.0-beta.1 <5.0.0-beta.32 · <4.24.15

Fixed in

4.24.15, 5.0.0-beta.32

NextAuthjs Email misdelivery Vulnerability

Affected

<4.24.12 · >=5.0.0-beta.0 <5.0.0-beta.30

Fixed in

4.24.12, 5.0.0-beta.30

Possible user mocking that bypasses basic authentication

Affected

<4.24.5

Fixed in

4.24.5

Missing proper state, nonce and PKCE checks for OAuth authentication

Affected

<4.20.1

Fixed in

4.20.1

next-auth before v4.10.2 and v3.29.9 leaks excessive information into log

Affected

<3.29.9 · >=4.0.0 <4.10.2

Fixed in

3.29.9, 4.10.2

NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails

Affected

>=4.0.0 <4.10.3 · <3.29.10

Fixed in

3.29.10, 4.10.3

Improper handling of email input

Affected

<3.29.8 · >=4.0.0 <4.9.0

Fixed in

3.29.8, 4.9.0

Improper Handling of `callbackUrl` parameter in next-auth

Affected

<3.29.5 · >=4.0.0 <4.5.0

Fixed in

3.29.5, 4.5.0

URL Redirection to Untrusted Site ('Open Redirect') in next-auth

Affected

<3.29.3 · >=4.0.0 <4.3.3

Fixed in

3.29.3, 4.3.3

NextAuth.js default redirect callback vulnerable to open redirects

Affected

<3.29.2 · >=4.0.0 <4.3.2

Fixed in

3.29.2, 4.3.2

Token verification bug in next-auth

Affected

<3.3.0

Fixed in

3.3.0