Executive brief
NextAuth.js is a popular authentication library used by web applications to handle user login via OAuth providers (Google, GitHub, etc.). An attacker who can intercept network traffic or trick a user into clicking a manipulated login link can strip away OAuth security checks (state, nonce, PKCE parameters) to hijack the login process and gain unauthorized access to victim accounts, effectively bypassing CSRF protections built into the OAuth flow.
Technical details
The vulnerability is a CSRF/session fixation issue (CWE-352, CWE-384) in NextAuth.js OAuth callback handling. NextAuth.js fails to properly validate the state, nonce, and PKCE parameters returned from the OAuth Authorization Server against the values stored in cookies. An attacker can intercept the authorization URL, remove these security parameters, and return the modified URL to the victim's browser. When the victim completes the OAuth login, the Authorization Server sends back a valid authorization code. Because NextAuth.js doesn't validate the missing parameters against the stored cookies, the check fails; however, the Authorization Server has already authenticated the victim and generated a code. The attacker can then replay the callback URL containing the code to log in as the victim. The attack requires network-level interception or social engineering (user clicking a malicious link) and user interaction. The vulnerability affects all versions prior to v4.20.1 and is fixed in v4.20.1 and later.
Affected products
- NextAuth.js next-auth < 4.20.1
Timeline
- 2023-03-09: disclosed
- 2023-03-13: patched: Fixed in v4.20.1