CVE-2022-24858: Open Redirect Vulnerability in next-auth
Summary
CVE-2022-24858: NextAuth.js default redirect callback vulnerable to open redirects. Affects next-auth across 2 version ranges.
< 3.29.2
>= 4.0.0, < 4.3.2
Fixed in 3.29.2 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
next-auth is an npm package that provides authentication for Next.js applications. It allows developers to easily implement authentication features such as sign-in, sign-up, and password reset. However, versions before 3.29.2 (for v3 users) and 4.3.2 (for v4 users) are vulnerable to an open redirect attack.
Vulnerability Detail
The vulnerability in next-auth allows an attacker to redirect users to malicious websites by manipulating the redirect URL. This can lead to various attacks, such as phishing or injecting malicious code into the redirected page. The vulnerability arises from the default redirect callback in next-auth, which does not properly validate the redirect URL. Attackers can exploit this by crafting a URL that appears legitimate but actually redirects users to a malicious site.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.29.23.29.2npm install next-auth@3.29.2 -
>= 4.0.0, < 4.3.24.3.2npm install next-auth@4.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading or adding the configuration is not possible, a temporary workaround is to manually validate the redirect URL in the existing redirect callback. Ensure that the incoming url origin matches the baseUrl to prevent open redirects. Here is an example of how to implement the workaround:
async redirect({ url, baseUrl }) {
// Validate the incoming URL origin
if (new URL(url).origin === baseUrl) return url
return baseUrl
}
Conclusion
The open redirect vulnerability in next-auth can be mitigated by upgrading to the latest version or implementing the provided workaround. It is crucial to address this vulnerability to prevent potential attacks and protect user data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for next-auth →
FAQ
next-auth is an npm package that provides authentication for Next.js applications. It simplifies the implementation of authentication features such as sign-in, sign-up, and password reset.
The vulnerability occurs due to the default redirect callback in next-auth not properly validating the redirect URL. Attackers can exploit this by crafting a URL that appears legitimate but actually redirects users to a malicious site.
The open redirect vulnerability in next-auth can lead to various attacks, such as phishing or injecting malicious code into the redirected page. Attackers can trick users into visiting malicious websites, potentially compromising their sensitive information.
To fix this vulnerability, it is recommended to upgrade to the latest version of next-auth (v3.29.2 for v3 users or v4.3.2 for v4 users). If upgrading is not possible, a configuration can be added to manually validate the redirect URL.
Yes, a temporary workaround is to manually validate the redirect URL in the existing redirect callback. Ensure that the incoming url origin matches the baseUrl to prevent open redirects.
References
Related vulnerabilities
Recent vulnerabilities recorded for next-auth.
