Is CVE-2022-29214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-29214 being exploited in the wild.

How severe is CVE-2022-29214?

Low severity, with a CVSS score of 3.1, published 24 May 2022.

Which products and versions are affected?

next-auth (npm) SEMVER:introduced=0,fixed=3.29.3.

Is there a fix for CVE-2022-29214?

Yes. next-auth (npm): upgrade to 3.29.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-29214 attacked?

It is attacked over the network.

Am I affected by CVE-2022-29214?

Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-29214: next-auth open redirect in OAuth callback

CVE-2022-29214 · Severity: low · CVSS 3.1 · Published 2022-05-24

next-auth is a popular authentication library for Next.js applications that handles OAuth provider integration. This vulnerability allows attackers to redirect users to untrusted external websites after login by manipulating the OAuth callback URL, potentially leading to phishing attacks or credential theft.

Technologies: next-auth (npm). Vendors: npm.

Quick answers

Is CVE-2022-29214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-29214 being exploited in the wild.
How severe is CVE-2022-29214?: Low severity, with a CVSS score of 3.1, published 24 May 2022.
Which products and versions are affected?: next-auth (npm) SEMVER:introduced=0,fixed=3.29.3.
Is there a fix for CVE-2022-29214?: Yes. next-auth (npm): upgrade to 3.29.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-29214 attacked?: It is attacked over the network.
Am I affected by CVE-2022-29214?: Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next-auth (npm): upgrade to 3.29.3 or later
```
npm install next-auth@3.29.3
```

Technical details

An open redirect vulnerability (CWE-601) exists in next-auth's redirect callback handling when OAuth providers are configured, particularly OAuth 1 providers such as Twitter. The vulnerability occurs because the library fails to properly validate that redirect URLs belong to the intended origin before redirecting users post-authentication. An unauthenticated attacker can craft a malicious link with an untrusted redirect URL that will be followed after OAuth login completes. Patches are available in next-auth v3.29.3 and v4.3.3; alternatively, developers can implement custom callback validation to restrict redirects to relative URLs or same-origin destinations.

Affected products

NextAuth next-auth before 3.29.3, 4.0.0 before 4.3.3

Identifiers

CVE-2022-29214
GHSA-q2mx-j4x2-2h74

Timeline

2022-05-24: disclosed: Published as GHSA-q2mx-j4x2-2h74
2022-05-24: patched: Patches released in v3.29.3 and v4.3.3
2022-04-20: other: Vulnerability reported

References

https://github.com/nextauthjs/next-auth/security/advisories/GHSA-q2mx-j4x2-2h74

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.