# CVE-2022-31186: next-auth information disclosure in OAuth error logs

Source: https://junglewise.ai/threats/cve-2022-31186-next-auth-information-disclosure-in-oauth-error-logs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-31186 · Severity: low · CVSS 3.1 · Published 2022-08-06

next-auth is an authentication library used by web applications to handle user login and OAuth provider integration. A flaw in error logging causes sensitive information—including OAuth provider secrets—to be written to application logs during authentication failures. An attacker with access to logs could steal these secrets and impersonate the application to request excessive user permissions.

Technologies: [next-auth (npm)](https://junglewise.ai/threats/technologies/next-auth). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-31186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-31186 being exploited in the wild.

**How severe is CVE-2022-31186?** Low severity, with a CVSS score of 3.1, published 6 August 2022.

**Which products and versions are affected?** next-auth (npm) SEMVER:introduced=0,fixed=3.29.9.

**Is there a fix for CVE-2022-31186?** Yes. next-auth (npm): upgrade to 3.29.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-31186 attacked?** It is attacked with local access.

**Am I affected by CVE-2022-31186?** Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next-auth (npm): upgrade to 3.29.9 or later

  ```sh
  npm install next-auth@3.29.9
  ```


## Technical details

The vulnerability is an information disclosure flaw (CWE-532) in next-auth's OAuth error handling logic. When OAuth provider errors occur, sensitive provider metadata—including secrets used for client authentication—are logged at standard log level rather than debug level. An attacker with local or application log access (requires low privileges) can extract these credentials without user interaction. The flaw affects versions before 4.10.2 and 3.29.9. Patches move sensitive provider logging to debug level only and add warnings when debug mode is enabled in production. Workarounds involve configuring custom logging with sanitization to strip provider secrets before writing logs.

## Affected products

- next-auth next-auth before 4.10.2 and 3.29.9

## Identifiers

- CVE-2022-31186
- GHSA-p6mm-27gq-9v3p

## Timeline

- 2022-07-18: disclosed
- 2022-08-01: patched: v4.10.2 and v3.29.9 released
- 2022-08-06: advisory: GHSA-p6mm-27gq-9v3p published

## References

- [https://github.com/nextauthjs/next-auth/security/advisories/GHSA-p6mm-27gq-9v3p](https://github.com/nextauthjs/next-auth/security/advisories/GHSA-p6mm-27gq-9v3p)

## Related threats

- [Auth.js authentication check bypass on configuration error](https://junglewise.ai/threats/cve-2026-73421-auth-js-authentication-check-bypass-on-configuration-error)
- [Auth.js email normalizer homoglyph @ bypass in passwordless sign-in](https://junglewise.ai/threats/cve-2026-73420-auth-js-email-normalizer-homoglyph-bypass-in-passwordless-sign-in)
- [Auth.js OAuth provider-confusion in state/nonce/PKCE cookies](https://junglewise.ai/threats/cve-2026-73419-auth-js-oauth-provider-confusion-in-state-nonce-pkce-cookies)
- [NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken()](https://junglewise.ai/threats/cve-2026-73418-auth-js-gettoken-exception-on-malformed-bearer-headers)
- [NextAuth.js email misdelivery via nodemailer address parser bug](https://junglewise.ai/threats/nextauth-js-email-misdelivery-via-nodemailer-address-parser-bug-6824743e)