Executive brief
Auth.js (formerly NextAuth.js) is a popular authentication library for web applications. A vulnerability exists where security checks used during the login process are not properly tied to a specific login provider. In applications that allow users to link multiple login methods (like Google and GitHub) while signed in, an attacker could trick a user into linking the attacker's account to the victim's profile, granting the attacker permanent access to the victim's account.
Technical details
Auth.js fails to bind OAuth/OIDC anti-CSRF tokens (state, nonce, and PKCE verifier) to the specific provider that initiated the request. Because these checks are stored in global cookies, a check value generated for one provider can be used to satisfy the callback for a different provider. In multi-provider configurations that support account linking while a user is logged in, an attacker can exploit this 'provider-confusion' to link their own identity provider account to a victim's session. This requires the attacker to observe at least one provider's authorization request and for the target provider to not require PKCE. Patches are available in @auth/core 0.41.3, next-auth 4.24.15, and next-auth 5.0.0-beta.32.
Affected products
- Auth.js @auth/core <= 0.41.2
- Auth.js next-auth <= 4.24.14, >= 5.0.0-beta.1, <= 5.0.0-beta.31
Timeline
- 2026-07-20: disclosed
- 2026-07-23: advisory: GitHub Advisory published