| Package | Affected versions | Patched versions |
|---|---|---|
| next-auth | ≥ 3.0.0, < 3.29.2≥ 4.0.0, < 4.3.2 | 3.29.24.3.2 |
| next-auth | ≥ 4.0.0, < 4.3.2< 3.29.2 | 4.3.23.29.2 |
next-auth v3 users before version 3.29.2 are impacted. (We recommend upgrading to v4 in most cases. See our migration guide).next-auth v4 users before version 4.3.2 are impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option:
// async redirect(url, baseUrl) { // v3
async redirect({ url, baseUrl }) { // v4
// Allows relative callback URLs
if (url.startsWith("/")) return new URL(url, baseUrl).toString()
// Allows callback URLs on the same origin
else if (new URL(url).origin === baseUrl) return url
return baseUrl
}
If you already have a redirect callback, make sure that you match the incoming url origin against the baseUrl.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free