Known vulnerabilities in next-auth

Software: next-auth
Software CPE: cpe:2.3:a:nextauthjs:next-auth:*:*:*:*:*:npm:*:*
Total vulnerabilities: 14
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting next-auth next-auth is affected by 14 known vulnerabilities: 2 high, 5 medium, 7 low Critical High Medium Low

Vulnerabilities (14)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU138945 - Improper input validation
CWE-20 Low
No
No
4.24.12, 5.0.0 beta.30 21.07.2026 SB20260721122
#VU138941 - Incorrect Behavior Order: Validate Before Canonicalize
CVE-2026-73420
CWE-180 High
No
No
4.24.15, 5.0.0 beta.32 21.07.2026 SB20260721120
#VU138939 - Insufficient Verification of Data Authenticity
CVE-2026-73419
CWE-345 High
No
No
4.24.15, 5.0.0 beta.32 21.07.2026 SB20260721120
#VU138927 - Improper input validation
CVE-2026-73418
CWE-20 Medium
No
No
4.24.15, 5.0.0 beta.32 21.07.2026 SB20260721120
#VU138925 - Improper Authorization
CVE-2026-73421
CWE-285 Medium
No
No
5.0.0 beta.32 21.07.2026 SB20260721120
#VU83351 - Incorrect Authorization
CVE-2022-35924
CWE-863 Low
No
No
3.29.10, 4.10.3 21.11.2023 SB2022081067
#VU83349 - Information Exposure Through Log Files
CVE-2022-31186
CWE-532 Low
No
No
3.29.9, 4.10.2 21.11.2023 SB2022080963
#VU83347 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-31127
CWE-79 Medium
No
No
3.29.8, 4.9.0 21.11.2023 SB2022071433
#VU83346 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2022-29214
CWE-601 Low
No
No
3.29.3, 4.3.3 21.11.2023 SB2022060728
#VU83344 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2022-24858
CWE-601 Low
No
No
3.29.3, 4.3.2 21.11.2023 SB2022042924
#VU83343 - Authentication Bypass by Spoofing
CVE-2021-21310
CWE-290 Medium
No
No
3.3.0 21.11.2023 SB2021021911
#VU83318 - Cross-Site Request Forgery (CSRF)
CVE-2023-27490
CWE-352 Medium
No
No
4.20.1 20.11.2023 SB2023030953
#VU83317 - Improper Authentication
CVE-2023-48309
CWE-287 Low
No
No
4.24.5 20.11.2023 SB2023112076
SB2024041135
#VU138944 - Improper input validation
CVE-2022-31093
CWE-20 Low
No
No
3.29.5, 4.5.0 20.06.2022 SB2022062045