# CVE-2022-24858: NextAuth.js default redirect callback open redirect

Source: https://junglewise.ai/threats/cve-2022-24858-nextauth-js-default-redirect-callback-open-redirect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-04-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-24858 · Severity: low · CVSS 3.1 · Published 2022-04-22

NextAuth.js is an authentication library for Next.js applications that handles user login and session management. The library's default redirect callback fails to properly validate URLs, allowing attackers to redirect users to malicious external websites after login. This can be exploited to conduct phishing attacks or deliver malware to authenticated users.

Technologies: [next-auth (npm)](https://junglewise.ai/threats/technologies/next-auth). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-24858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-24858 being exploited in the wild.

**How severe is CVE-2022-24858?** Low severity, with a CVSS score of 3.1, published 22 April 2022.

**Which products and versions are affected?** next-auth (npm) SEMVER:introduced=0,fixed=3.29.2.

**Is there a fix for CVE-2022-24858?** Yes. next-auth (npm): upgrade to 3.29.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-24858 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-24858?** Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next-auth (npm): upgrade to 3.29.2 or later

  ```sh
  npm install next-auth@3.29.2
  ```


## Technical details

The vulnerability is a URL open redirect (CWE-601) in NextAuth.js's default redirect callback. The vulnerable component fails to validate that redirect URLs belong to the same origin before allowing the redirect, accepting any URL provided via user input. An attacker can craft a login URL with a malicious redirect parameter that, after authentication succeeds, sends the user to a phishing or malware site. No special privileges are required, but user interaction (clicking a link) is necessary. The attack is network-reachable. Patches are available in versions 3.29.2 and 4.3.2; alternatively, a custom redirect callback can validate URL origins against the baseUrl.

## Affected products

- NextAuth.js next-auth all versions before 3.29.2 and 4.0.0 before 4.3.2

## Identifiers

- CVE-2022-24858
- GHSA-f9wg-5f46-cjmw

## Timeline

- 2022-04-19: disclosed: NVD publication date
- 2022-04-22: disclosed: GHSA published
- 2022-04-22: patched: Versions 3.29.2 and 4.3.2 released with patch

## References

- [https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw](https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw)

## Related threats

- [Auth.js authentication check bypass on configuration error](https://junglewise.ai/threats/cve-2026-73421-auth-js-authentication-check-bypass-on-configuration-error)
- [Auth.js email normalizer homoglyph @ bypass in passwordless sign-in](https://junglewise.ai/threats/cve-2026-73420-auth-js-email-normalizer-homoglyph-bypass-in-passwordless-sign-in)
- [Auth.js OAuth provider-confusion in state/nonce/PKCE cookies](https://junglewise.ai/threats/cve-2026-73419-auth-js-oauth-provider-confusion-in-state-nonce-pkce-cookies)
- [NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken()](https://junglewise.ai/threats/cve-2026-73418-auth-js-gettoken-exception-on-malformed-bearer-headers)
- [NextAuth.js email misdelivery via nodemailer address parser bug](https://junglewise.ai/threats/nextauth-js-email-misdelivery-via-nodemailer-address-parser-bug-6824743e)