# CVE-2023-48309: NextAuth.js authentication bypass via mock user creation

Source: https://junglewise.ai/threats/cve-2023-48309-nextauth-js-authentication-bypass-via-mock-user-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-11-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-48309 · Severity: low · CVSS 3.1 · Published 2023-11-20

NextAuth.js is an authentication library for Next.js web applications. An attacker who obtains a JWT from an interrupted OAuth sign-in flow can forge a session cookie to create a mock user account with no associated data, bypassing authentication checks. While this grants only minimal access (viewing authenticated UI states without real user data), it allows unauthorized access to features that should require login.

Technologies: [next-auth (npm)](https://junglewise.ai/threats/technologies/next-auth). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-48309 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-48309 being exploited in the wild.

**How severe is CVE-2023-48309?** Low severity, with a CVSS score of 3.1, published 20 November 2023.

**Which products and versions are affected?** next-auth (npm) SEMVER:introduced=0,fixed=4.24.5.

**Is there a fix for CVE-2023-48309?** Yes. next-auth (npm): upgrade to 4.24.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-48309 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-48309?** Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next-auth (npm): upgrade to 4.24.5 or later

  ```sh
  npm install next-auth@4.24.5
  ```


## Technical details

The vulnerability is an improper authorization issue (CWE-285) in NextAuth.js versions before 4.24.5. An attacker can intercept a JWT token generated during an OAuth sign-in flow (from state, PKCE, or nonce parameters) and manually replace the next-auth.session-token cookie with this non-related JWT. The default Middleware authorization does not validate that the token contains legitimate user information, allowing the creation of a mock user with only a random opaque string as the user identifier. This enables session spoofing without requiring legitimate credentials, though the mock user cannot access other users' data or resources protected by proper authorization scopes. The fix is available in version 4.24.5; alternatively, developers can implement a custom authorization callback checking for the presence of user properties like email.

## Affected products

- NextAuth.js next-auth before 4.24.5

## Identifiers

- CVE-2023-48309
- GHSA-v64w-49xw-qq89

## Timeline

- 2023-11-20: disclosed
- 2023-11-20: patched: Fixed in v4.24.5

## References

- [https://github.com/nextauthjs/next-auth/security/advisories/GHSA-v64w-49xw-qq89](https://github.com/nextauthjs/next-auth/security/advisories/GHSA-v64w-49xw-qq89)

## Related threats

- [Auth.js authentication check bypass on configuration error](https://junglewise.ai/threats/cve-2026-73421-auth-js-authentication-check-bypass-on-configuration-error)
- [Auth.js email normalizer homoglyph @ bypass in passwordless sign-in](https://junglewise.ai/threats/cve-2026-73420-auth-js-email-normalizer-homoglyph-bypass-in-passwordless-sign-in)
- [Auth.js OAuth provider-confusion in state/nonce/PKCE cookies](https://junglewise.ai/threats/cve-2026-73419-auth-js-oauth-provider-confusion-in-state-nonce-pkce-cookies)
- [NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken()](https://junglewise.ai/threats/cve-2026-73418-auth-js-gettoken-exception-on-malformed-bearer-headers)
- [NextAuth.js email misdelivery via nodemailer address parser bug](https://junglewise.ai/threats/nextauth-js-email-misdelivery-via-nodemailer-address-parser-bug-6824743e)