CVE-2022-31186

Katalog CVE

CVSS 3.3 · Low EPSS 0,26%

Kerentanan Insertion of Sensitive Information into Log File pada next-auth nextauth.js. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.

Rincian

Terbit di NVD

1 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://next-auth.js.org/configuration/options#logger advisory vendor
• https://next-auth.js.org/getting-started/upgrade-v4 advisory vendor
• https://next-auth.js.org/warnings#debug_enabled advisory vendor
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-p6mm-27gq-9v3p advisory pihak ketiga