Executive brief
NextAuth.js is an authentication framework for web applications that supports email-based sign-in. A parsing bug in its email handling library (nodemailer) allows attackers to craft malicious email addresses that redirect login and verification emails to attacker-controlled mailboxes instead of the intended recipients. An attacker can exploit this to intercept sensitive authentication tokens and account verification links meant for legitimate users.
Technical details
The vulnerability is rooted in nodemailer's RFC 5321/5322 non-compliant email address parser. When processing email sign-in requests, NextAuth.js passes user-supplied email addresses to nodemailer for sending authentication emails. A crafted input such as "e@attacker.com"@victim.com is misparsed, resulting in the message being delivered to e@attacker.com (attacker-controlled) instead of the intended recipient at victim.com. This occurs because the parser incorrectly handles quoted strings in email addresses. No authentication is required; the vulnerability is exploitable by submitting a malicious email address via the sign-in form. An attacker can receive login links, password reset tokens, or email verification codes intended for a victim. The vulnerability is patched in NextAuth.js versions 4.24.12 and 5.0.0-beta.30 by updating to nodemailer 7.0.7 or later.
Affected products
- NextAuthjs next-auth <4.24.12, <5.0.0-beta.30
Timeline
- 2025-10-29: disclosed: Advisory GHSA-5jpx-9hw9-2fx4 published
- 2025-10-27: patched: Patches released in next-auth 4.24.12 and 5.0.0-beta.30