CVE-2022-29214

Name of the Vulnerable Software and Affected Versions NextAuth.js versions prior to 3.29.3 NextAuth.js versions prior to 4.3.3

Description The issue is an open redirect vulnerability present when implementing an OAuth 1 provider, such as Twitter. This vulnerability is addressed in versions 3.29.3 and 4.3.3. Users of next-auth v3 are recommended to upgrade to v4, as v3 is considered unmaintained.

Recommendations For versions prior to 3.29.3, upgrade to version 3.29.3 or later. For versions prior to 4.3.3, upgrade to version 4.3.3 or later. As a temporary workaround for those unable to upgrade, add the following configuration to the callbacks option:

async redirect({ url, baseUrl }) {
  if (url.startsWith("/")) return `${baseUrl}${url}`
  else if (new URL(url).origin === baseUrl) return url
  return baseUrl
}