Is CVE-2023-48309 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-48309 being exploited in the wild.

How severe is CVE-2023-48309?

Low severity, with a CVSS score of 3.1, published 20 November 2023.

Which products and versions are affected?

next-auth (npm) SEMVER:introduced=0,fixed=4.24.5.

Is there a fix for CVE-2023-48309?

Yes. next-auth (npm): upgrade to 4.24.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-48309 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-48309?

Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-48309: NextAuth.js authentication bypass via mock user creation

CVE-2023-48309 · Severity: low · CVSS 3.1 · Published 2023-11-20

NextAuth.js is an authentication library for Next.js web applications. An attacker who obtains a JWT from an interrupted OAuth sign-in flow can forge a session cookie to create a mock user account with no associated data, bypassing authentication checks. While this grants only minimal access (viewing authenticated UI states without real user data), it allows unauthorized access to features that should require login.

Technologies: next-auth (npm). Vendors: npm.

Quick answers

Is CVE-2023-48309 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-48309 being exploited in the wild.
How severe is CVE-2023-48309?: Low severity, with a CVSS score of 3.1, published 20 November 2023.
Which products and versions are affected?: next-auth (npm) SEMVER:introduced=0,fixed=4.24.5.
Is there a fix for CVE-2023-48309?: Yes. next-auth (npm): upgrade to 4.24.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-48309 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-48309?: Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next-auth (npm): upgrade to 4.24.5 or later
```
npm install next-auth@4.24.5
```

Technical details

The vulnerability is an improper authorization issue (CWE-285) in NextAuth.js versions before 4.24.5. An attacker can intercept a JWT token generated during an OAuth sign-in flow (from state, PKCE, or nonce parameters) and manually replace the next-auth.session-token cookie with this non-related JWT. The default Middleware authorization does not validate that the token contains legitimate user information, allowing the creation of a mock user with only a random opaque string as the user identifier. This enables session spoofing without requiring legitimate credentials, though the mock user cannot access other users' data or resources protected by proper authorization scopes. The fix is available in version 4.24.5; alternatively, developers can implement a custom authorization callback checking for the presence of user properties like email.

Affected products

NextAuth.js next-auth before 4.24.5

Identifiers

CVE-2023-48309
GHSA-v64w-49xw-qq89

Timeline

2023-11-20: disclosed
2023-11-20: patched: Fixed in v4.24.5

References

https://github.com/nextauthjs/next-auth/security/advisories/GHSA-v64w-49xw-qq89

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.