Is CVE-2022-31186 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-31186 being exploited in the wild.

How severe is CVE-2022-31186?

Low severity, with a CVSS score of 3.1, published 6 August 2022.

Which products and versions are affected?

next-auth (npm) SEMVER:introduced=0,fixed=3.29.9.

Is there a fix for CVE-2022-31186?

Yes. next-auth (npm): upgrade to 3.29.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-31186 attacked?

It is attacked with local access.

Am I affected by CVE-2022-31186?

Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-31186: next-auth information disclosure in OAuth error logs

CVE-2022-31186 · Severity: low · CVSS 3.1 · Published 2022-08-06

next-auth is an authentication library used by web applications to handle user login and OAuth provider integration. A flaw in error logging causes sensitive information—including OAuth provider secrets—to be written to application logs during authentication failures. An attacker with access to logs could steal these secrets and impersonate the application to request excessive user permissions.

Technologies: next-auth (npm). Vendors: npm.

Quick answers

Is CVE-2022-31186 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-31186 being exploited in the wild.
How severe is CVE-2022-31186?: Low severity, with a CVSS score of 3.1, published 6 August 2022.
Which products and versions are affected?: next-auth (npm) SEMVER:introduced=0,fixed=3.29.9.
Is there a fix for CVE-2022-31186?: Yes. next-auth (npm): upgrade to 3.29.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-31186 attacked?: It is attacked with local access.
Am I affected by CVE-2022-31186?: Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next-auth (npm): upgrade to 3.29.9 or later
```
npm install next-auth@3.29.9
```

Technical details

The vulnerability is an information disclosure flaw (CWE-532) in next-auth's OAuth error handling logic. When OAuth provider errors occur, sensitive provider metadata—including secrets used for client authentication—are logged at standard log level rather than debug level. An attacker with local or application log access (requires low privileges) can extract these credentials without user interaction. The flaw affects versions before 4.10.2 and 3.29.9. Patches move sensitive provider logging to debug level only and add warnings when debug mode is enabled in production. Workarounds involve configuring custom logging with sanitization to strip provider secrets before writing logs.

Affected products

next-auth next-auth before 4.10.2 and 3.29.9

Identifiers

CVE-2022-31186
GHSA-p6mm-27gq-9v3p

Timeline

2022-07-18: disclosed
2022-08-01: patched: v4.10.2 and v3.29.9 released
2022-08-06: advisory: GHSA-p6mm-27gq-9v3p published

References

https://github.com/nextauthjs/next-auth/security/advisories/GHSA-p6mm-27gq-9v3p

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.