CVE Reports

Posted on Jul 24 • Originally published at cvereports.com

GHSA-X445-F3H2-J279: GHSA-X445-F3H2-J279: OAuth Provider Confusion in Auth.js and NextAuth.js

#security #cve #cybersecurity #ghsa

GHSA-X445-F3H2-J279: OAuth Provider Confusion in Auth.js and NextAuth.js

Vulnerability ID: GHSA-X445-F3H2-J279
CVSS Score: 7.5
Published: 2026-07-23

A critical logical security flaw exists in Auth.js (formerly NextAuth.js) where signed anti-CSRF check cookies (state, nonce, and PKCE code_verifier) are not bound to the specific Identity Provider that initiated the authorization flow. In multi-provider environments, this allows an attacker to replay valid, cryptographically signed cookies minted during a flow with one provider against a callback handling a different provider. This vulnerability can lead to session hijacking, identity theft, or unauthorized account linking.

TL;DR

Auth.js and NextAuth.js fail to bind anti-CSRF cookies to specific OAuth identity providers, allowing attackers to replay session parameters across provider callback boundaries and dynamically link unauthorized identity accounts.

⚠️ Exploit Status: POC

Technical Details

Vulnerability ID: GHSA-X445-F3H2-J279
Weakness Class: CWE-384 (Session Fixation) / CWE-352 (CSRF)
CVSS v3.1 Score: 7.5 (High)
Attack Vector: Network / Remote
User Interaction: Required (Targeted redirect execution)
Exploit Status: PoC (Verified in test suite)
Patched Versions: next-auth >= 4.24.15, next-auth >= 5.0.0-beta.32, @auth/core >= 0.41.3

Affected Systems

NextAuth.js v4
NextAuth.js v5 Beta
Auth.js Core
next-auth: < 4.24.15 (Fixed in: 4.24.15)
next-auth (v5): < 5.0.0-beta.32 (Fixed in: 5.0.0-beta.32)
@auth/core: < 0.41.3 (Fixed in: 0.41.3)

Code Analysis

Commit: 5bca239

Fix OAuth provider confusion in next-auth v4 checks by binding active provider ID to check cookies.

Commit: 9f7a97f

Fix OAuth provider confusion in @auth/core (v5) by adding provider constraint to state, nonce, and PKCE validation.

Exploit Details

GitHub test suite: The official PR includes an integration unit-test suite checking the verification failures under provider mismatch scenarios.

Mitigation Strategies

Upgrade NextAuth.js and Auth.js core dependencies to the fixed versions.
Avoid assigning overlapping or duplicate identity provider IDs in dynamic multi-tenant configurations.
Implement explicit consent steps or email validation requirements before executing dynamic account linking.

Remediation Steps:

Identify current versions of next-auth or @auth/core in use via package.json.
Run the appropriate package manager installation command to pull the security update: next-auth@4.24.15, next-auth@5.0.0-beta.32, or @auth/core@0.41.3.
Verify that active sessions are reset and users re-authenticate to refresh session parameter state structures.

References

Read the full report for GHSA-X445-F3H2-J279 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community