next-auth
4.24.15Authentication for the Web.
- Maintenance
- Slow0 commits in 3 months · bus factor 2
- License
- ISCPermissive · OSI-approved
- Security
- 15 advisories2 critical, 7 high, 4 medium, 2 low · Scorecard 4.9/10
- Supported versions
- No scheduleendoflife.date does not track this project
28.4k stars · 4k forks · 607 open issues · last release 3 months ago · data checked 44 minutes ago
Security advisories
All advisories on GitHubThe 15 most recent advisories published by the maintainers: 2 critical, 7 high, 4 medium, 2 low. Check the patched version against the one you run.
- mediumCVE-2026-73419Jul 20, 2026OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
- Affected
- <= 0.41.2; >= 5.0.0-beta.1, <= 5.0.0-beta.31; <= 4.24.14
- Patched in
- 0.41.3; 5.0.0-beta.32; 4.24.15
- lowCVE-2026-73421Jul 20, 2026Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
- Affected
- >= 5.0.0-beta.0, <= 5.0.0-beta.31
- Patched in
- 5.0.0-beta.32
- highCVE-2026-73420Jul 20, 2026Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
- Affected
- >= 0.1.0, < 0.41.3; >= 4.10.3, < 4.24.15; >= 5.0.0-beta.1, <= 5.0.0-beta.31
- Patched in
- 0.41.3; 4.24.15; 5.0.0-beta.32
- highCVE-2026-73418Jul 20, 2026getToken() throws an uncaught exception on malformed Bearer authorization headers
- Affected
- >= 0.1.0, < 0.41.3; >= 5.0.0-beta.0, <= 5.0.0-beta.31; >= 4.0.6, <= 4.24.14
- Patched in
- 0.41.3; 5.0.0-beta.32; 4.24.15
- mediumGHSA-5jpx-9hw9-2fx4Oct 27, 2025NextAuthjs Email misdelivery Vulnerability
- Affected
- <4.24.12; <5.0.0-beta.30
- Patched in
- 4.24.12; 5.0.0-beta.30
- mediumCVE-2023-48309Nov 20, 2023Possible user mocking that bypasses basic authentication
- Affected
- <4.24.5
- Patched in
- 4.24.5
- highCVE-2023-27490Mar 9, 2023Missing proper state, nonce and PKCE checks for OAuth authentication
- Affected
- <4.20.1
- Patched in
- 4.20.1
- mediumCVE-2022-39263Sep 28, 2022Missing token verification in Upstash Adapter
- Affected
- < 3.0.2
- Patched in
- v3.0.2
- criticalCVE-2022-35924Aug 2, 2022Sending verification requests (magic link) to unwanted emails
- Affected
- <4.10.3, <3.29.10
- Patched in
- 4.10.3, 3.29.10
- lowCVE-2022-31186Jul 26, 2022Leakage of excessive information into log in next-auth
- Affected
- <4.10.2, <3.29.9
- Patched in
- 4.10.2, 3.29.9
- highCVE-2022-31127Jul 6, 2022Improper handling of email input
- Affected
- <3.29.8, <4.9.0
- Patched in
- 3.29.8, 4.9.0
- highCVE-2022-31093Jun 20, 2022Improper Handling of `callbackUrl` parameter in next-auth
- Affected
- <3.29.5, <4.5.0
- Patched in
- 3.29.5, 4.5.0
- highCVE-2022-29214May 10, 2022URL Redirection to Untrusted Site ('Open Redirect') in next-auth
- Affected
- <3.29.3, <4.3.3
- Patched in
- 3.29.3, 4.3.3
- highCVE-2022-24858Apr 19, 2022Default redirect callback vulnerable to open redirects
- Affected
- <3.29.2, <4.3.2
- Patched in
- 3.29.2, 4.3.2
- criticalCVE-2021-21310Feb 11, 2021Insecure email token verification in Prisma adapter
- Affected
- < 3.3.0
- Patched in
- 3.3.0