Executive brief
NextAuth is a popular authentication library for Next.js applications. An attacker can inject malicious HTML into email verification messages by crafting a specially-formatted email address, enabling phishing attacks. Users who click links in compromised verification emails may be directed to attacker-controlled sites to harvest credentials.
Technical details
This is a cross-site scripting (XSS) / improper input validation vulnerability in NextAuth's email authentication provider. The root cause is that user-supplied email input is rendered directly in the HTML body of verification emails without sanitization. An attacker can craft an email address containing HTML/JavaScript payloads (e.g., `balazs@email.com, <a href="http://attacker.com">Claim money!</a>`) that will be interpreted as HTML when the email is displayed. The attack requires user interaction (clicking the malicious link in the email) but has a network attack vector since the payload is submitted to the email endpoint. Patches are available in v3.29.8 and v4.9.0; the fix removes email rendering from the HTML body or sanitizes it.
Affected products
- NextAuth NextAuth v3 <3.29.8; v4 4.0.0-4.8.x
Timeline
- 2022-06-29: disclosed: Issue reported
- 2022-07-06: advisory: GHSA-pgjx-7f9g-9463 published
- 2022-07-06: patched: Patches released in v3.29.8 and v4.9.0