PT-2022-19467 · Unknown · Nextauth.Js

Ry0Tak

·

Published

2022-05-20

·

Updated

2022-06-07

·

CVE-2022-29214

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions NextAuth.js versions prior to 3.29.3 NextAuth.js versions prior to 4.3.3
Description The issue is an open redirect vulnerability present when implementing an OAuth 1 provider, such as Twitter. This vulnerability is addressed in versions 3.29.3 and 4.3.3. Users of next-auth v3 are recommended to upgrade to v4, as v3 is considered unmaintained.
Recommendations For versions prior to 3.29.3, upgrade to version 3.29.3 or later. For versions prior to 4.3.3, upgrade to version 4.3.3 or later. As a temporary workaround for those unable to upgrade, add the following configuration to the callbacks option:
ts
async redirect({ url, baseUrl }) {
  if (url.startsWith("/")) return `${baseUrl}${url}`
  else if (new URL(url).origin === baseUrl) return url
  return baseUrl
}

Exploit

Fix

Open Redirect

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-29214
GHSA-Q2MX-J4X2-2H74

Affected Products

Nextauth.Js