# CVE-2023-27490: NextAuth.js missing OAuth state, nonce and PKCE validation

Source: https://junglewise.ai/threats/cve-2023-27490-nextauth-js-missing-oauth-state-nonce-and-pkce-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-27490 · Severity: low · CVSS 3.1 · Published 2023-03-13

NextAuth.js is a popular authentication library used by web applications to handle user login via OAuth providers (Google, GitHub, etc.). An attacker who can intercept network traffic or trick a user into clicking a manipulated login link can strip away OAuth security checks (state, nonce, PKCE parameters) to hijack the login process and gain unauthorized access to victim accounts, effectively bypassing CSRF protections built into the OAuth flow.

Technologies: [next-auth (npm)](https://junglewise.ai/threats/technologies/next-auth). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-27490 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-27490 being exploited in the wild.

**How severe is CVE-2023-27490?** Low severity, with a CVSS score of 3.1, published 13 March 2023.

**Which products and versions are affected?** next-auth (npm) SEMVER:introduced=0,fixed=4.20.1.

**Is there a fix for CVE-2023-27490?** Yes. next-auth (npm): upgrade to 4.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-27490 attacked?** It is attacked over the network or from the adjacent network.

**Am I affected by CVE-2023-27490?** Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next-auth (npm): upgrade to 4.20.1 or later

  ```sh
  npm install next-auth@4.20.1
  ```


## Technical details

The vulnerability is a CSRF/session fixation issue (CWE-352, CWE-384) in NextAuth.js OAuth callback handling. NextAuth.js fails to properly validate the state, nonce, and PKCE parameters returned from the OAuth Authorization Server against the values stored in cookies. An attacker can intercept the authorization URL, remove these security parameters, and return the modified URL to the victim's browser. When the victim completes the OAuth login, the Authorization Server sends back a valid authorization code. Because NextAuth.js doesn't validate the missing parameters against the stored cookies, the check fails; however, the Authorization Server has already authenticated the victim and generated a code. The attacker can then replay the callback URL containing the code to log in as the victim. The attack requires network-level interception or social engineering (user clicking a malicious link) and user interaction. The vulnerability affects all versions prior to v4.20.1 and is fixed in v4.20.1 and later.

## Affected products

- NextAuth.js next-auth < 4.20.1

## Identifiers

- CVE-2023-27490
- GHSA-7r7x-4c4q-c4qf

## Timeline

- 2023-03-09: disclosed
- 2023-03-13: patched: Fixed in v4.20.1

## References

- [https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf](https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf)

## Related threats

- [Auth.js authentication check bypass on configuration error](https://junglewise.ai/threats/cve-2026-73421-auth-js-authentication-check-bypass-on-configuration-error)
- [Auth.js email normalizer homoglyph @ bypass in passwordless sign-in](https://junglewise.ai/threats/cve-2026-73420-auth-js-email-normalizer-homoglyph-bypass-in-passwordless-sign-in)
- [Auth.js OAuth provider-confusion in state/nonce/PKCE cookies](https://junglewise.ai/threats/cve-2026-73419-auth-js-oauth-provider-confusion-in-state-nonce-pkce-cookies)
- [NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken()](https://junglewise.ai/threats/cve-2026-73418-auth-js-gettoken-exception-on-malformed-bearer-headers)
- [NextAuth.js email misdelivery via nodemailer address parser bug](https://junglewise.ai/threats/nextauth-js-email-misdelivery-via-nodemailer-address-parser-bug-6824743e)