CVE-2022-31093 Improper Handling of `callbackUrl` parameter in next-auth
An attacker can cause a denial of service and login failures by sending a malformed callbackUrl parameter to NextAuth.js applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31093?
CVE-2022-31093 is a high-severity denial of service vulnerability in nextauthjs next-auth, published on 27 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.
Weakness: CWE-754
Which versions are affected by CVE-2022-31093?
4 open source packages ship an affected version, including next-auth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next-auth npm | All versions | 3.29.5 |
next-auth npm | All versions | 3.29.5 |
next-auth npm | From 4.0.0 | 4.5.0 |
next-auth npm | From 4.0.0 | 4.5.0 |
Products include Nextauth.js Next-Auth.
How do I fix CVE-2022-31093?
Upgrade next-auth to a fixed version for your release line: 3.29.5 or 4.5.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-31093 being exploited?
There is no known exploitation of CVE-2022-31093 in the wild and no public exploit code.
Other vulnerabilities in nextauthjs next-auth
- CVE-2022-35924 Verification requests (magic link) sent to unwanted emails
- CVE-2023-27490 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth
- CVE-2022-31127 Improper handling of email input in next-auth
- CVE-2022-39263 NextAuth.js Upstash Adapter missing token verification
- CVE-2022-29214 URL Redirection to Untrusted Site ('Open Redirect') in next-auth
Sources
Also known as GHSA-g5fm-jp9v-2432.