Vulnerabilities in NextAuth.js software