Authentication bypass in NextAuth.js Prisma database adapter

1) Authentication Bypass by Spoofing

EUVDB-ID: #VU83343

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21310

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper authentication in Prisma database adapter, which checks verification token but not the identifier (the email address associated with the token). A remote attacker can bypass authentication process.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

next-auth: 3.0.0 - 3.29.10

External links

http://github.com/nextauthjs/next-auth/releases/tag/v3.3.0
http://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.