Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth

CVE-2023-27490

What is CVE-2023-27490?

An authentication vulnerability has been discovered in NextAuth.js affecting OAuth providers before version 4.20.1. This issue enables potential attackers to intercept and manipulate the authorization URL, allowing unauthorized login as the victim. This can occur if the attacker gains access to network traffic or convinces the victim to click on a modified login link. Affected users are urged to upgrade their applications to version 4.20.1 or later. If an upgrade is not immediately possible, users should manually validate the callback request parameters such as state, pkce, and nonce to mitigate the risk.

References