Vulnerability Database · npm · next-auth · Version
next-auth 0.0.0-pr.6777.ae645ec0
0.0.0-pr.6777.ae645ec0 is affected by 9 vulnerabilities.
The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 4.24.15.
Critical 0 High 3 Medium 4 Low 2 Unrated 0
-
Released 24 Feb 2023
Licence ISC
Also known from other sources 11
Newer releases 300
Database updated 23/Oct/2026
Release and licence data published by the npm registry. Licence information is not legal advice.
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Vulnerabilities affecting this version
next-auth 0.0.0-pr.6777.ae645ec0 vulnerabilities
9 vulnerabilities cover next-auth 0.0.0-pr.6777.ae645ec0. Open the full list in the database.
| Vulnerability | Severity | Fixed version | Disclosed |
|---|---|---|---|
| CVE-2023-27490: Vulnerability in next-auth package - Missing proper state, nonce and PKCE checks for OAuth authentication | 8.1 high | 4.20.1 | 13 Mar 2023 |
| CVE-2022-31093: Improper Handling of `callbackUrl` parameter in next-auth | 7.5 high | 3.29.5 | 21 Jun 2022 |
| CVE-2022-31127: Improper handling of email input in next-auth | 7.1 high | 3.29.8 | 06 Jul 2022 |
| Email Misdelivery Vulnerability in NextAuth.js | 6.9 medium | 4.24.12 | 29 Oct 2025 |
| CVE-2022-29214: URL Redirection to Untrusted Site in next-auth | 6.1 medium | 3.29.3 | 24 May 2022 |
| CVE-2022-24858: Open Redirect Vulnerability in next-auth | 6.1 medium | 3.29.2 | 22 Apr 2022 |
| CVE-2023-48309: Vulnerability in next-auth | 5.3 medium | 4.24.5 | 20 Nov 2023 |
| CVE-2022-31186: Information Disclosure in next-auth | 3.3 low | 3.29.9 | 06 Aug 2022 |
| CVE-2021-21310: Token verification bug in next-auth | N/A low | 3.3.0 | 11 Feb 2021 |
Looking for another version, or everything Vulert holds for next-auth?
Questions
About next-auth 0.0.0-pr.6777.ae645ec0
Is next-auth 0.0.0-pr.6777.ae645ec0 vulnerable?
Yes. 9 vulnerabilities in the Vulert database cover next-auth 0.0.0-pr.6777.ae645ec0: 0 critical, 3 high, 4 medium and 2 low. The upgrade Vulert recommends is 4.24.15, and each entry above names the fixed version to move to.
Which version of next-auth should I use instead of 0.0.0-pr.6777.ae645ec0?
4.24.15 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.
Is 0.0.0-pr.6777.ae645ec0 the latest release of next-auth?
No. 0.0.0-pr.6777.ae645ec0 was published 24 Feb 2023, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.
How do I monitor next-auth for upcoming vulnerabilities?
Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the next-auth version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.