Executive brief
NextAuth.js is an authentication library used by web applications to manage user login and session handling. Attackers could inject multiple email addresses into a sign-in request, causing magic link verification emails to be sent to unintended recipients. This allows an attacker to bypass email-based authorization checks and gain unauthorized access to accounts belonging to other users.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in the EmailProvider component. When processing sign-in requests, NextAuth.js failed to normalize email addresses before use, allowing attackers to forge requests containing comma-separated email lists (e.g., attacker@attacker.com,victim@victim.com). The application would send magic link emails to both addresses and allow login with the concatenated email string. This bypasses basic authorization checks such as email.endsWith("@victim.com"), enabling account takeover even when using domain-based access controls. No authentication is required to exploit this vulnerability. Patches are available in versions 4.10.3 and 3.29.10, which normalize email input and add a normalizeIdentifier callback for stricter validation.
Affected products
- NextAuth.js NextAuth.js 4.0.0 to 4.10.2, all versions before 3.29.10
Timeline
- 2022-08-02: disclosed: Vulnerability published
- 2022-08-02: patched: Patches released in versions 4.10.3 and 3.29.10