Is CVE-2022-35924 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-35924 being exploited in the wild.

How severe is CVE-2022-35924?

Low severity, with a CVSS score of 3.1, published 2 August 2022.

Which products and versions are affected?

next-auth (npm) SEMVER:introduced=4.0.0,fixed=4.10.3.

Is there a fix for CVE-2022-35924?

Yes. next-auth (npm): upgrade to 4.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-35924 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-35924?

Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-35924: NextAuth.js improper email validation in magic link authentication

CVE-2022-35924 · Severity: low · CVSS 3.1 · Published 2022-08-02

NextAuth.js is an authentication library used by web applications to manage user login and session handling. Attackers could inject multiple email addresses into a sign-in request, causing magic link verification emails to be sent to unintended recipients. This allows an attacker to bypass email-based authorization checks and gain unauthorized access to accounts belonging to other users.

Technologies: next-auth (npm). Vendors: npm.

Quick answers

Is CVE-2022-35924 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-35924 being exploited in the wild.
How severe is CVE-2022-35924?: Low severity, with a CVSS score of 3.1, published 2 August 2022.
Which products and versions are affected?: next-auth (npm) SEMVER:introduced=4.0.0,fixed=4.10.3.
Is there a fix for CVE-2022-35924?: Yes. next-auth (npm): upgrade to 4.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-35924 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-35924?: Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next-auth (npm): upgrade to 4.10.3 or later
```
npm install next-auth@4.10.3
```

Technical details

The vulnerability is an improper input validation flaw (CWE-20) in the EmailProvider component. When processing sign-in requests, NextAuth.js failed to normalize email addresses before use, allowing attackers to forge requests containing comma-separated email lists (e.g., attacker@attacker.com,victim@victim.com). The application would send magic link emails to both addresses and allow login with the concatenated email string. This bypasses basic authorization checks such as email.endsWith("@victim.com"), enabling account takeover even when using domain-based access controls. No authentication is required to exploit this vulnerability. Patches are available in versions 4.10.3 and 3.29.10, which normalize email input and add a normalizeIdentifier callback for stricter validation.

Affected products

NextAuth.js NextAuth.js 4.0.0 to 4.10.2, all versions before 3.29.10

Identifiers

CVE-2022-35924
GHSA-xv97-c62v-4587

Timeline

2022-08-02: disclosed: Vulnerability published
2022-08-02: patched: Patches released in versions 4.10.3 and 3.29.10

References

https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xv97-c62v-4587

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.