CVE-2022-31093

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Improper Check for Unusual or Exceptional Conditions pada nextauth.js next-auth. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.

Rincian

Terbit di NVD

27 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-754: Improper Check for Unusual or Exceptional Conditions

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://next-auth.js.org/configuration/initialization#advanced-initialization advisory vendor
• https://github.com/nextauthjs/next-auth/commit/25517b73153332d948114bacdff3b5908de91d85 patch · advisory pihak ketiga
• https://github.com/nextauthjs/next-auth/commit/e498483b23273d1bfc81be68339607f88d411bd6 patch · advisory pihak ketiga
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-g5fm-jp9v-2432 mitigasi · advisory pihak ketiga