CVE-2022-29214: falha de média gravidade em nextauthjs next-auth
URL Redirection to Untrusted Site ('Open Redirect') in next-auth
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.7%
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Prior to versions 3.29.3 and 4.3.3, an open redirect vulnerability is present when the developer is implementing an OAuth 1 provider. Versions 3.29.3 and 4.3.3 contain a patch for this issue. The maintainers recommend adding a certain configuration to one's `callbacks` option as a workaround for those unable to upgrade.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
nextauthjs · next-authCVEs relacionadas — nextauthjs next-auth
No mesmo produto, das mais perigosas para as menos.
CVE-2022-31093HIGHImproper Handling of `callbackUrl` parameter in next-authEPSS 1.7%CVE-2021-21310MEDIUMToken verification bug in next-authEPSS 1.7%CVE-2022-35924CRITICALVerification requests (magic link) sent to unwanted emailsEPSS 1.5%CVE-2022-31127HIGHImproper handling of email input in next-authEPSS 1.1%CVE-2026-73418HIGHNextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headersEPSS 0.9%CVE-2022-24858MEDIUMDefault redirect callback vulnerable to open redirectsEPSS 0.8%