CVE-2022-24858CWE-290

Default redirect callback vulnerable to open redirects

Medium · published April 19, 2022

CVSS v3.1
6.1
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00790 · 55.8th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2022-04-19T22:25Z
EPSS history
Timeline
  • 19 APR 22:25Z
    Default redirect callback vulnerable to open redirects
    cvelistv5