Quick answers
- Is CVE-2022-31093 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-31093 being exploited in the wild.
- How severe is CVE-2022-31093?
- Low severity, with a CVSS score of 3.1, published 21 June 2022.
- Which products and versions are affected?
- next-auth (npm) SEMVER:introduced=0,fixed=3.29.5.
- Is there a fix for CVE-2022-31093?
- Yes. next-auth (npm): upgrade to 3.29.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-31093 attacked?
- It is attacked over the network.
- Am I affected by CVE-2022-31093?
- Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- next-auth (npm): upgrade to 3.29.5 or later
npm install next-auth@3.29.5
Technical details
This is an improper parameter handling vulnerability (CWE-233/CWE-754) in NextAuth's callback URL validation. When an attacker supplies a malformed URL string as the callbackUrl query parameter, the code attempts to instantiate a URL object without validating the input first, causing a thrown exception. The unhandled error causes the API route handler to timeout and authentication to fail. The vulnerability affects NextAuth v3 (before 3.29.5) and v4 (before 4.5.0). Attack requires only a network connection with no authentication or user interaction. Patches are available in v3.29.5 and v4.5.0.
Affected products
- NextAuth next-auth <3.29.5, 4.0.0-4.4.x
Identifiers
- CVE-2022-31093
- GHSA-g5fm-jp9v-2432
Timeline
- 2022-06-21: disclosed
- 2022-06-21: patched: v3.29.5 and v4.5.0 released