Executive brief
next-auth is an authentication library used by web applications to handle user login and OAuth provider integration. A flaw in error logging causes sensitive information—including OAuth provider secrets—to be written to application logs during authentication failures. An attacker with access to logs could steal these secrets and impersonate the application to request excessive user permissions.
Technical details
The vulnerability is an information disclosure flaw (CWE-532) in next-auth's OAuth error handling logic. When OAuth provider errors occur, sensitive provider metadata—including secrets used for client authentication—are logged at standard log level rather than debug level. An attacker with local or application log access (requires low privileges) can extract these credentials without user interaction. The flaw affects versions before 4.10.2 and 3.29.9. Patches move sensitive provider logging to debug level only and add warnings when debug mode is enabled in production. Workarounds involve configuring custom logging with sanitization to strip provider secrets before writing logs.
Affected products
- next-auth next-auth before 4.10.2 and 3.29.9
Timeline
- 2022-07-18: disclosed
- 2022-08-01: patched: v4.10.2 and v3.29.9 released
- 2022-08-06: advisory: GHSA-p6mm-27gq-9v3p published