Executive brief
next-auth is a popular authentication library for Next.js applications that handles OAuth provider integration. This vulnerability allows attackers to redirect users to untrusted external websites after login by manipulating the OAuth callback URL, potentially leading to phishing attacks or credential theft.
Technical details
An open redirect vulnerability (CWE-601) exists in next-auth's redirect callback handling when OAuth providers are configured, particularly OAuth 1 providers such as Twitter. The vulnerability occurs because the library fails to properly validate that redirect URLs belong to the intended origin before redirecting users post-authentication. An unauthenticated attacker can craft a malicious link with an untrusted redirect URL that will be followed after OAuth login completes. Patches are available in next-auth v3.29.3 and v4.3.3; alternatively, developers can implement custom callback validation to restrict redirects to relative URLs or same-origin destinations.
Affected products
- NextAuth next-auth before 3.29.3, 4.0.0 before 4.3.3
Timeline
- 2022-05-24: disclosed: Published as GHSA-q2mx-j4x2-2h74
- 2022-05-24: patched: Patches released in v3.29.3 and v4.3.3
- 2022-04-20: other: Vulnerability reported