CVE-2023-27490: Vulnerability in next-auth package - Missing proper state, nonce and PKCE checks for OAuth authentication
Summary
CVE-2023-27490: Missing proper state, nonce and PKCE checks for OAuth authentication. Affects next-auth versions < 4.20.1. Fixed in 4.20.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The next-auth package is an open-source authentication library for Next.js applications. It provides a simple and customizable way to implement authentication features, including OAuth authentication with various providers. The package is widely used in the Node.js ecosystem and is known for its ease of use and flexibility. However, versions of next-auth prior to v4.20.1 are vulnerable to a security issue related to OAuth authentication.
Vulnerability Detail
The vulnerability in the next-auth package arises from the lack of proper checks for state, nonce, and PKCE (Proof Key for Code Exchange) during OAuth authentication. This allows a malicious actor who can intercept the victim's network traffic or manipulate the victim into clicking a manipulated login link to log in as the victim, bypassing CSRF (Cross-Site Request Forgery) protection. The attack involves intercepting and tampering with the authorization URL created by next-auth, removing the necessary checks, and tricking the victim into logging in using their OAuth account. The attacker can then use the intercepted authorization URL to automatically log in as the victim. This vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 4.24.15 as of 23 Oct 2026
npm install next-auth@4.24.15Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.20.1
This is the first release that contains the fix.
npm install next-auth@4.20.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
In addition to upgrading to the latest version, developers can manually check the callback request for state, pkce, and nonce against the provider configuration using Advanced Initialization. If there is a mismatch, the sign-in process can be aborted. The source code of the next-auth package provides guidance on implementing this workaround. However, upgrading to the latest version is the recommended solution.
Conclusion
The next-auth package prior to v4.20.1 is vulnerable to a security issue related to OAuth authentication. This vulnerability allows an attacker to log in as the victim by intercepting and tampering with the authorization URL. To mitigate this risk, it is crucial to upgrade to the latest version of the next-auth package (v4.20.1) or implement the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for next-auth →
FAQ
The vulnerability allows an attacker to log in as the victim by intercepting and tampering with the authorization URL during OAuth authentication. This can lead to unauthorized access to the victim's account and potential misuse of their personal information.
Versions of the next-auth package prior to v4.20.1 are affected by this vulnerability.
There are no known exploits of this vulnerability at the time of this report. However, it is important to promptly upgrade to the latest version to mitigate the risk.
Yes, the vulnerability has been fixed in the latest version of the next-auth package (v4.20.1). Upgrading to this version is recommended to address the issue.
While upgrading to the latest version is the recommended solution, developers can implement a workaround by manually checking the callback request for state, pkce, and nonce against the provider configuration. If there is a mismatch, the sign-in process can be aborted.
References
Related vulnerabilities
Recent vulnerabilities recorded for next-auth.
