CVE-2022-31093: Improper Handling of `callbackUrl` parameter in next-auth
First published: Mon Jun 27 2022(Updated: )
NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextauth.js Next-auth | >=3.0.0<3.29.5 | |
| Nextauth.js Next-auth | >=4.0.0<4.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/nextauthjs/next-auth/commit/25517b73153332d948114bacdff3b5908de91d85
- https://github.com/nextauthjs/next-auth/commit/e498483b23273d1bfc81be68339607f88d411bd6
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-g5fm-jp9v-2432
- https://next-auth.js.org/configuration/initialization#advanced-initialization
Frequently Asked Questions
What is CVE-2022-31093?
CVE-2022-31093 is a vulnerability in NextAuth.js that allows an attacker to send a request with an invalid callbackUrl, leading to a URL instantiation failure.
How does CVE-2022-31093 affect NextAuth.js?
CVE-2022-31093 affects NextAuth.js versions 3.0.0 to 3.29.5 and versions 4.0.0 to 4.5.0.
What is the severity of CVE-2022-31093?
The severity of CVE-2022-31093 is rated as high with a CVSS score of 7.5.
How can an attacker exploit CVE-2022-31093?
An attacker can exploit CVE-2022-31093 by sending a request with an invalid callbackUrl parameter.
How can I fix CVE-2022-31093?
To fix CVE-2022-31093, update NextAuth.js to a version beyond 3.29.5 or 4.5.0.
- collector/nvd-index
- agent/references
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/title
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/nextauth.js
- canonical/nextauth.js next-auth
- version/nextauth.js next-auth/3.0.0
- version/nextauth.js next-auth/4.0.0