Is CVE-2023-27490 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-27490 being exploited in the wild.

How severe is CVE-2023-27490?

Low severity, with a CVSS score of 3.1, published 13 March 2023.

Which products and versions are affected?

next-auth (npm) SEMVER:introduced=0,fixed=4.20.1.

Is there a fix for CVE-2023-27490?

Yes. next-auth (npm): upgrade to 4.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-27490 attacked?

It is attacked over the network or from the adjacent network.

Am I affected by CVE-2023-27490?

Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-27490: NextAuth.js missing OAuth state, nonce and PKCE validation

CVE-2023-27490 · Severity: low · CVSS 3.1 · Published 2023-03-13

NextAuth.js is a popular authentication library used by web applications to handle user login via OAuth providers (Google, GitHub, etc.). An attacker who can intercept network traffic or trick a user into clicking a manipulated login link can strip away OAuth security checks (state, nonce, PKCE parameters) to hijack the login process and gain unauthorized access to victim accounts, effectively bypassing CSRF protections built into the OAuth flow.

Technologies: next-auth (npm). Vendors: npm.

Quick answers

Is CVE-2023-27490 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-27490 being exploited in the wild.
How severe is CVE-2023-27490?: Low severity, with a CVSS score of 3.1, published 13 March 2023.
Which products and versions are affected?: next-auth (npm) SEMVER:introduced=0,fixed=4.20.1.
Is there a fix for CVE-2023-27490?: Yes. next-auth (npm): upgrade to 4.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-27490 attacked?: It is attacked over the network or from the adjacent network.
Am I affected by CVE-2023-27490?: Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next-auth (npm): upgrade to 4.20.1 or later
```
npm install next-auth@4.20.1
```

Technical details

The vulnerability is a CSRF/session fixation issue (CWE-352, CWE-384) in NextAuth.js OAuth callback handling. NextAuth.js fails to properly validate the state, nonce, and PKCE parameters returned from the OAuth Authorization Server against the values stored in cookies. An attacker can intercept the authorization URL, remove these security parameters, and return the modified URL to the victim's browser. When the victim completes the OAuth login, the Authorization Server sends back a valid authorization code. Because NextAuth.js doesn't validate the missing parameters against the stored cookies, the check fails; however, the Authorization Server has already authenticated the victim and generated a code. The attacker can then replay the callback URL containing the code to log in as the victim. The attack requires network-level interception or social engineering (user clicking a malicious link) and user interaction. The vulnerability affects all versions prior to v4.20.1 and is fixed in v4.20.1 and later.

Affected products

NextAuth.js next-auth < 4.20.1

Identifiers

CVE-2023-27490
GHSA-7r7x-4c4q-c4qf

Timeline

2023-03-09: disclosed
2023-03-13: patched: Fixed in v4.20.1

References

https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.