Vulnerabilities in nextauthjs
14 resultsCVE-2022-31093HIGHImproper Handling of `callbackUrl` parameter in next-authEPSS 1.7%CVE-2021-21310MEDIUMToken verification bug in next-authEPSS 1.7%CVE-2022-35924CRITICALVerification requests (magic link) sent to unwanted emailsEPSS 1.5%CVE-2022-31127HIGHImproper handling of email input in next-authEPSS 1.1%CVE-2026-73418HIGHNextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headersEPSS 0.9%CVE-2022-24858MEDIUMDefault redirect callback vulnerable to open redirectsEPSS 0.8%CVE-2026-73420CRITICALNextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypassEPSS 0.7%CVE-2022-39263MEDIUMNextAuth.js Upstash Adapter missing token verificationEPSS 0.7%CVE-2023-48309MEDIUMnext-auth vulnerable to possible user mocking that bypasses basic authenticationEPSS 0.7%CVE-2022-29214MEDIUMURL Redirection to Untrusted Site ('Open Redirect') in next-authEPSS 0.7%CVE-2026-73421CRITICALNextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)EPSS 0.6%CVE-2023-27490HIGHMissing proper state, nonce and PKCE checks for OAuth authentication in next-authEPSS 0.5%CVE-2022-31186LOWLeakage of excessive information into log in next-authEPSS 0.3%CVE-2026-73419MEDIUMNextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created themEPSS 0.2%