PT-2021-14408 · Unknown+1 · Nextauth.Js+1

Alessandro Angelino + 1 · Published 2021-02-11 · Updated 2021-02-19 · CVE-2021-21310

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: NextAuth.js versions prior to 3.3.0

Description: The issue is related to a token verification vulnerability in NextAuth.js, specifically affecting implementations that use the Prisma database adapter in conjunction with the Email provider. The Prisma database adapter was checking the verification token but not verifying the email address associated with that token, allowing an attacker to use a valid token to sign in as another user. This issue is specific to the community-supported Prisma adapter and is not present in the default database adapter.

Recommendations: For versions prior to 3.3.0, update to version 3.3.0 or newer to resolve the issue. As a temporary workaround, consider disabling the Email provider until a patch is available.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2021-21310

GHSA-PG53-56CG-4M8Q

Affected Products

Nextauth.Js

Prismax

References · 8

• 🔥 https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21310 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21310 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pg53-56cg-4m8q · Vendor Advisory
• https://github.com/nextauthjs/next-auth/releases/tag/v3.3.0 · Note
• https://t.me/cvenotify/9829 · Telegram Post
• https://t.me/cibsecurity/23504 · Telegram Post
• https://npmjs.com/package/next-auth · Note