Executive brief
NextAuth is an authentication library for Next.js applications. An attacker can send a malformed callbackUrl parameter to trigger an unhandled error that causes the authentication API route to hang and fail, preventing users from logging in.
Technical details
This is an improper parameter handling vulnerability (CWE-233/CWE-754) in NextAuth's callback URL validation. When an attacker supplies a malformed URL string as the callbackUrl query parameter, the code attempts to instantiate a URL object without validating the input first, causing a thrown exception. The unhandled error causes the API route handler to timeout and authentication to fail. The vulnerability affects NextAuth v3 (before 3.29.5) and v4 (before 4.5.0). Attack requires only a network connection with no authentication or user interaction. Patches are available in v3.29.5 and v4.5.0.
Affected products
- NextAuth next-auth <3.29.5, 4.0.0-4.4.x
Timeline
- 2022-06-21: disclosed
- 2022-06-21: patched: v3.29.5 and v4.5.0 released