Executive brief
NextAuth.js is an authentication library for Next.js web applications. An attacker who obtains a JWT from an interrupted OAuth sign-in flow can forge a session cookie to create a mock user account with no associated data, bypassing authentication checks. While this grants only minimal access (viewing authenticated UI states without real user data), it allows unauthorized access to features that should require login.
Technical details
The vulnerability is an improper authorization issue (CWE-285) in NextAuth.js versions before 4.24.5. An attacker can intercept a JWT token generated during an OAuth sign-in flow (from state, PKCE, or nonce parameters) and manually replace the next-auth.session-token cookie with this non-related JWT. The default Middleware authorization does not validate that the token contains legitimate user information, allowing the creation of a mock user with only a random opaque string as the user identifier. This enables session spoofing without requiring legitimate credentials, though the mock user cannot access other users' data or resources protected by proper authorization scopes. The fix is available in version 4.24.5; alternatively, developers can implement a custom authorization callback checking for the presence of user properties like email.
Affected products
- NextAuth.js next-auth before 4.24.5
Timeline
- 2023-11-20: disclosed
- 2023-11-20: patched: Fixed in v4.24.5