CVE-2022-29214 URL Redirection to Untrusted Site ('Open Redirect') in next-auth
An open redirect vulnerability in next-auth allows attackers to redirect users to untrusted sites when using OAuth 1 providers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-29214?
CVE-2022-29214 is a medium-severity vulnerability in nextauthjs next-auth, published on 20 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Prior to versions 3.29.3 and 4.3.3, an open redirect vulnerability is present when the developer is implementing an OAuth 1 provider. Versions 3.29.3 and 4.3.3 contain a patch for this issue. The maintainers recommend adding a certain configuration to one's `callbacks` option as a workaround for those unable to upgrade.
Weakness: CWE-601
Which versions are affected by CVE-2022-29214?
4 open source packages ship an affected version, including next-auth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next-auth npm | All versions | 3.29.3 |
next-auth npm | All versions | 3.29.3 |
next-auth npm | From 4.0.0 | 4.3.3 |
next-auth npm | From 4.0.0 | 4.3.3 |
Products include Nextauth.js Next-Auth.
How do I fix CVE-2022-29214?
Upgrade next-auth to a fixed version for your release line: 3.29.3 or 4.3.3.
Is CVE-2022-29214 being exploited?
There is no known exploitation of CVE-2022-29214 in the wild and no public exploit code.
Other vulnerabilities in nextauthjs next-auth
- CVE-2022-35924 Verification requests (magic link) sent to unwanted emails
- CVE-2023-27490 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth
- CVE-2022-31093 Improper Handling of `callbackUrl` parameter in next-auth
- CVE-2022-31127 Improper handling of email input in next-auth
- CVE-2022-39263 NextAuth.js Upstash Adapter missing token verification
Sources
Also known as GHSA-q2mx-j4x2-2h74.