CVE-2022-31186: Leakage of excessive information into log in next-auth
First published: Mon Aug 01 2022(Updated: )
NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NextAuth.js | <3.29.9 | |
| NextAuth.js | >=4.0.0<4.10.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-31186?
CVE-2022-31186 has been classified as a moderate severity vulnerability.
How do I fix CVE-2022-31186?
To fix CVE-2022-31186, upgrade NextAuth.js to version 4.10.2 or 3.29.9 or later.
What type of vulnerability is CVE-2022-31186?
CVE-2022-31186 is an information disclosure vulnerability.
Who is affected by CVE-2022-31186?
CVE-2022-31186 affects NextAuth.js versions prior to 4.10.2 and 3.29.9.
How can attackers exploit CVE-2022-31186?
Attackers can exploit CVE-2022-31186 by gaining log access privileges to obtain excessive information.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/next-auth
- canonical/nextauth.js
- version/nextauth.js/4.0.0