CVE-2022-24858
NextAuth.js default redirect callback vulnerable to open redirects
Description
`next-auth` v3 users before version 3.29.2 are impacted. (We recommend upgrading to v4 in most cases. See our [migration guide](https://next-auth.js.org/getting-started/upgrade-v4)).`next-auth` v4 users before version 4.3.2 are impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your `callbacks` option: ```js // async redirect(url, baseUrl) { // v3 async redirect({ url, baseUrl }) { // v4 // Allows relative callback URLs if (url.startsWith("/")) return new URL(url, baseUrl).toString() // Allows callback URLs on the same origin else if (new URL(url).origin === baseUrl) return url return baseUrl } ``` If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.
How to fix CVE-2022-24858
To remediate CVE-2022-24858, upgrade the affected package to a fixed version below.
- —upgrade to 3.29.2 or later
Is CVE-2022-24858 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 3.29.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |