Executive brief
Auth.js is a widely-used authentication library used to add login features to web applications. The library stores security tokens (state, nonce, and PKCE verification codes) in cookies that are not tied to specific OAuth providers. This allows an attacker to trick an authentication system into linking their account to a victim's legitimate user account, enabling persistent unauthorized access. The vulnerability only affects systems supporting multiple login providers with account linking while logged in.
Technical details
Auth.js stores OAuth/OIDC anti-CSRF checks (state, nonce, and PKCE verifier) in global cookies without binding them to the originating provider. During callback processing, a check value created for one provider can be consumed by a different provider because the stored cookie is not verified against the callback provider's identity (provider ID, issuer, client ID, or redirect URI). The attack is a provider-confusion/mix-up attack requiring: (1) multiple OAuth/OIDC providers configured, (2) account linking allowed while logged in, (3) at least one provider's authorization request observable by an attacker, and (4) at least one target provider not enforcing PKCE. An attacker can then link their account at a target provider to a victim's user by intercepting and replaying checks. The fix binds OAuth check cookies to the specific provider/authorization flow that created them.
Affected products
- Auth.js @auth/core <= 0.41.2
- Auth.js next-auth <= 4.24.14 and >= 5.0.0-beta.1, <= 5.0.0-beta.31
Timeline
- 2026-07-23: disclosed
- 2026-07-23: patched: @auth/core 0.41.3, next-auth 4.24.15 and 5.0.0-beta.32