Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2022-35924: NextAuth.js email login can send magic links to wrong addresses
CVE-2022-35924 · published 4 years ago
Summary
If you use NextAuth.js with email login in versions before 4.10.3 or 3.29.10, an attacker can trick the system into sending sign‑in emails to both their own address and a victim’s address. This lets the attacker log in as a combined email address and bypass simple checks that look only at the domain. Update to the latest version of NextAuth.js as soon as possible; there are no reliable work‑arounds other than upgrading.
What to do
- Update himself_65 next-auth to version 4.10.3.
- Update himself_65 next-auth to version 3.29.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | himself_65 | next-auth |
>= 4.0.0, < 4.10.3 < 3.29.10 Fix: upgrade to 4.10.3
|
| – | nextauth.js | next-auth |
< 3.29.10 >= 4.0.0, < 4.10.3 cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:node.js:*:* |
Original advisory text
Verification requests (magic link) sent to unwanted emails
NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions before `4.10.3` or `3.29.10` are affected. If an attacker could forge a request that sent a comma-separated list of emails (eg.: `[email protected],[email protected]`) to the sign-in endpoint, NextAuth.js would send emails to both the attacker and the victim's e-mail addresses. The attacker could then login as a newly created user with the email being `[email protected],[email protected]`. This means that basic authorization like `email.endsWith("@victim.com")` in the `signIn` callback would fail to communicate a threat to the developer and would let the attacker bypass authorization, even with an `@attacker.com` address. This vulnerability has been patched in `v4.10.3` and `v3.29.10` by normalizing the email value that is sent to the sign-in endpoint before accessing it anywhere else. We also added a `normalizeIdentifier` callback on the `EmailProvider` configuration, where you can further tweak your requirements for what your system considers a valid e-mail address. (E.g.: strict RFC2821 compliance). Users are advised to upgrade. There are no known workarounds for this vulnerability. If for some reason you cannot upgrade, you can normalize the incoming request using Advanced Initialization.
References
- https://next-auth.js.org/providers/email#normalizing-the-email-address
- https://github.com/advisories/GHSA-xv97-c62v-4587
- https://en.wikipedia.org/wiki/Email_address#Local-part URL
- https://next-auth.js.org/configuration/callbacks#sign-in-callback URL
- https://next-auth.js.org/configuration/initialization#advanced-initialization URL
- https://next-auth.js.org/providers/email URL
- https://next-auth.js.org/providers/email#normalizing-the-e-mail-address URL
- https://nodemailer.com/message/addresses URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35924... Vendor Advisory
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xv97-c62v-4587 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-35924 Vendor Advisory
- https://github.com/nextauthjs/next-auth/commit/afb1fcdae3cc30445038ef588e491d139... Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-20Improper Input Validation
CWE-863Incorrect Authorization
Timeline
Published2 Aug 2022
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta