CVE-2021-21310: Token verification bug in next-auth
Summary
CVE-2021-21310: Token verification bug in next-auth. Affects next-auth versions < 3.3.0. Fixed in 3.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NextAuth.js is an open-source authentication library for Next.js applications. It provides a set of utilities and authentication strategies to simplify the implementation of authentication in web applications. The library supports various authentication providers, including email, social media, and external identity providers. The Prisma database adapter is a community-supported adapter for NextAuth.js that allows integration with the Prisma database ORM. This vulnerability affects NextAuth.js implementations using the Prisma database adapter with the Email provider.
Vulnerability Detail
The Prisma database adapter in NextAuth.js had a token verification bug that allowed an attacker to use a valid token assigned to one user to sign in as another user. This vulnerability was specific to the community-supported Prisma database adapter in versions prior to 3.3.0 and did not affect the default database adapter (TypeORM). The bug was a result of not checking the identifier (email address) associated with the token during verification. This flaw could potentially lead to unauthorized access and privilege escalation in affected applications.
How To Fix
Latest published version: 4.24.15 as of 23 Oct 2026
npm install next-auth@4.24.15Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.0
This is the first release that contains the fix.
npm install next-auth@3.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is to disable the Email provider in NextAuth.js. This can be done by modifying the NextAuth.js configuration to remove the Email provider configuration and related code. However, this workaround should be considered temporary, and upgrading to the latest version is still recommended for a permanent fix.
Conclusion
The token verification bug in the Prisma database adapter of NextAuth.js allowed for unauthorized access and potential privilege escalation. It is crucial for developers to upgrade to version 3.3.0 or newer to fix this vulnerability. Disabling the Email provider can serve as a temporary workaround until the upgrade is performed. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for next-auth →
FAQ
Versions of NextAuth.js prior to 3.3.0 that use the Prisma database adapter with the Email provider are affected.
No, applications using the default database adapter (TypeORM) with the Email provider are not affected by this vulnerability.
No, applications that do not use a database are not affected by this vulnerability.
The Prisma database adapter is the only known affected adapter. However, similar vulnerabilities may exist in other third-party database adapters that do not properly check both the identifier and token values during verification.
The design of the database adapter API may be revised in the future to reduce the likelihood of similar vulnerabilities. However, specific details about the planned revisions are not provided in the advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for next-auth.
