CVE-2022-39263 NextAuth.js Upstash Adapter missing token verification
Attackers can bypass email verification and sign in as victims by exploiting missing token checks in the Upstash Redis adapter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-39263?
CVE-2022-39263 is a medium-severity authentication bypass vulnerability in nextauthjs next-auth, published on 28 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. The vulnerability is patched in v3.0.2. A workaround is available. Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding.
Weakness: CWE-287
Which versions are affected by CVE-2022-39263?
2 open source packages ship an affected version, including @next-auth/upstash-redis-adapter. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@next-auth/upstash-redis-adapter npm | All versions | 3.0.2 |
@next-auth/upstash-redis-adapter npm | All versions | 3.0.2 |
Products include Nextauth.js Next-Auth.
How do I fix CVE-2022-39263?
Upgrade @next-auth/upstash-redis-adapter to 3.0.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-39263 being exploited?
There is no known exploitation of CVE-2022-39263 in the wild and no public exploit code.
Other vulnerabilities in nextauthjs next-auth
- CVE-2022-35924 Verification requests (magic link) sent to unwanted emails
- CVE-2023-27490 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth
- CVE-2022-31093 Improper Handling of `callbackUrl` parameter in next-auth
- CVE-2022-31127 Improper handling of email input in next-auth
- CVE-2022-29214 URL Redirection to Untrusted Site ('Open Redirect') in next-auth
Sources
Also known as GHSA-4rxr-27mm-mxq9.