# CVE-2021-21310: NextAuth.js insecure email token verification in Prisma adapter

Source: https://junglewise.ai/threats/cve-2021-21310-nextauth-js-insecure-email-token-verification-in-prisma-adapter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-02-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-21310 · Severity: info · Published 2021-02-11

NextAuth.js is an authentication library for Next.js applications that supports sign-in via email verification links. A flaw in the Prisma database adapter's token verification logic allowed attackers to reuse a valid verification token issued to one user to sign in as a different user. This affects only implementations using both the Prisma adapter and the Email provider, potentially enabling account takeover attacks.

Technologies: [next-auth (npm)](https://junglewise.ai/threats/technologies/next-auth). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-21310 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-21310 being exploited in the wild.

**How severe is CVE-2021-21310?** Informational severity, published 11 February 2021.

**Which products and versions are affected?** next-auth (npm) SEMVER:introduced=0,fixed=3.3.0.

**Is there a fix for CVE-2021-21310?** Yes. next-auth (npm): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-21310 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-21310?** Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next-auth (npm): upgrade to 3.3.0 or later

  ```sh
  npm install next-auth@3.3.0
  ```


## Technical details

The vulnerability is an insecure authentication token verification flaw (CWE-290) in the Prisma database adapter of NextAuth.js versions prior to 3.3.0. The adapter was validating the verification token but failing to validate the identifier (email address) associated with that token. This allows an attacker with a valid token intended for one email address to authenticate as a different user by submitting the same token. The attack requires knowledge of a valid token and network access to the application; no additional authentication is required. The vulnerability is specific to implementations using both the Prisma adapter and the Email provider—users of the default TypeORM adapter or other authentication methods are unaffected. The issue was patched in version 3.3.0 (released 2021-02-09).

## Affected products

- NextAuth.js next-auth < 3.3.0

## Identifiers

- CVE-2021-21310
- GHSA-pg53-56cg-4m8q

## Timeline

- 2021-02-08: disclosed: Vulnerability reported via responsible disclosure
- 2021-02-09: patched: Fix released in version 3.3.0
- 2021-02-10: advisory: CVE-2021-21310 assigned
- 2021-02-11: advisory: Public advisory published

## References

- [https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q](https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q)

## Related threats

- [Auth.js authentication check bypass on configuration error](https://junglewise.ai/threats/cve-2026-73421-auth-js-authentication-check-bypass-on-configuration-error)
- [Auth.js email normalizer homoglyph @ bypass in passwordless sign-in](https://junglewise.ai/threats/cve-2026-73420-auth-js-email-normalizer-homoglyph-bypass-in-passwordless-sign-in)
- [Auth.js OAuth provider-confusion in state/nonce/PKCE cookies](https://junglewise.ai/threats/cve-2026-73419-auth-js-oauth-provider-confusion-in-state-nonce-pkce-cookies)
- [NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken()](https://junglewise.ai/threats/cve-2026-73418-auth-js-gettoken-exception-on-malformed-bearer-headers)
- [NextAuth.js email misdelivery via nodemailer address parser bug](https://junglewise.ai/threats/nextauth-js-email-misdelivery-via-nodemailer-address-parser-bug-6824743e)