CVE-2023-48309 next-auth vulnerable to possible user mocking that bypasses basic authentication
Attackers can bypass authentication by injecting a JWT from an interrupted OAuth flow, allowing them to simulate a logged-in state and view protected UI elements.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-48309?
CVE-2023-48309 is a medium-severity authentication bypass vulnerability in nextauthjs next-auth, published on 20 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow (state, PKCE or nonce). Manually overriding the `next-auth.session-token` cookie value with this non-related JWT would let the user simulate a logged in user, albeit having no user information associated with it. (The only property on this user is an opaque randomly generated string). This vulnerability does not give access to other users' data, neither to resources that require proper authorization via scopes or other means. The created mock user has no information associated with it (ie. no name, email, access_token, etc.) This vulnerability can be exploited by bad actors to peek at logged in user states (e.g. dashboard layout). `next-auth` `v4.24.5` contains a patch for the vulnerability. As a workaround, using a custom authorization callback for Middleware, developers can manually do a basic authentication.
Which versions are affected by CVE-2023-48309?
2 open source packages ship an affected version, including next-auth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next-auth npm | All versions | 4.24.5 |
next-auth npm | All versions | 4.24.5 |
Products include Nextauth.js Next-Auth.
How do I fix CVE-2023-48309?
Upgrade next-auth to 4.24.5 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-48309 being exploited?
There is no known exploitation of CVE-2023-48309 in the wild and no public exploit code.
Other vulnerabilities in nextauthjs next-auth
- CVE-2022-35924 Verification requests (magic link) sent to unwanted emails
- CVE-2023-27490 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth
- CVE-2022-31093 Improper Handling of `callbackUrl` parameter in next-auth
- CVE-2022-31127 Improper handling of email input in next-auth
- CVE-2022-39263 NextAuth.js Upstash Adapter missing token verification
Sources
Also known as GHSA-v64w-49xw-qq89.