Critical · published August 2, 2022
🚨 A single forged request could let an attacker sign in as anyone! NextAuth.js versions before 4.10.3 and 3.29.10 have a sneaky flaw that could expose your users' accounts. 🔥 Think of it like a restaurant that accepts reservations based on a single name—if someone yells in the name of a guest and another hidden name, both get seated! This vulnerability allows attackers to forge email requests, letting them slip right past your defenses like a clever con artist. 🤯 An attacker can manipulate the sign-in process by sending a comma-separated list of emails, allowing them to log in as any user specified. This could lead to unauthorized access, where the attacker can view or change user data, potentially causing chaos and confusion for your organization. Yikes!
Think of it like a restaurant that accepts reservations based on a single name—if someone yells in the name of a guest and another hidden name, both get seated! This vulnerability allows attackers to forge email requests, letting them slip right past your defenses like a clever con artist. 🤯 This vulnerability arises because NextAuth.js fails to properly validate email addresses when signing in with the EmailProvider. The attacker can craft a malicious request that bypasses basic authorization checks due to improper email normalization.
An attacker can manipulate the sign-in process by sending a comma-separated list of emails, allowing them to log in as any user specified. This could lead to unauthorized access, where the attacker can view or change user data, potentially causing chaos and confusion for your organization. Yikes! Upgrade to NextAuth.js version 4.10.3 or 3.29.10 immediately. If upgrading isn't feasible, consider normalizing incoming requests manually using Advanced Initialization to sanitize the email input. Don't put this off—act now! 🛡️ You've got this! By following these steps, you can protect your application and keep your users safe. Let’s secure those accounts! 💪✨