Executive brief
NextAuth.js is an authentication library for Next.js applications that handles user login and session management. The library's default redirect callback fails to properly validate URLs, allowing attackers to redirect users to malicious external websites after login. This can be exploited to conduct phishing attacks or deliver malware to authenticated users.
Technical details
The vulnerability is a URL open redirect (CWE-601) in NextAuth.js's default redirect callback. The vulnerable component fails to validate that redirect URLs belong to the same origin before allowing the redirect, accepting any URL provided via user input. An attacker can craft a login URL with a malicious redirect parameter that, after authentication succeeds, sends the user to a phishing or malware site. No special privileges are required, but user interaction (clicking a link) is necessary. The attack is network-reachable. Patches are available in versions 3.29.2 and 4.3.2; alternatively, a custom redirect callback can validate URL origins against the baseUrl.
Affected products
- NextAuth.js next-auth all versions before 3.29.2 and 4.0.0 before 4.3.2
Timeline
- 2022-04-19: disclosed: NVD publication date
- 2022-04-22: disclosed: GHSA published
- 2022-04-22: patched: Versions 3.29.2 and 4.3.2 released with patch