URL Redirection to Untrusted Site ('Open Redirect') in next-auth
Impact
We found that this vulnerability is present when the developer is implementing an OAuth 1 provider (by extension, it means Twitter, which is the only built-in provider using OAuth 1), but upgrading is still recommended.
next-auth v3 users before version 3.29.3 are impacted. (We recommend upgrading to v4, as v3 is considered unmaintained. See our migration guide)
next-auth v4 users before version 4.3.3 are impacted.
Patches
We've released patches for this vulnerability in:
- v3 -
3.29.3 - v4 -
4.3.3
You can do:
npm i next-auth@latestor
yarn add next-auth@latestor
pnpm add next-auth@latest(This will update to the latest v4 version, but you can change latest to 3 if you want to stay on v3.)
Workarounds
If you are not able to upgrade for any reason, you can add the following configuration to your callbacks option:
// async redirect(url, baseUrl) { // v3
async redirect({ url, baseUrl }) { // v4
// Allows relative callback URLs
if (url.startsWith("/")) return `${baseUrl}${url}`
// Allows callback URLs on the same origin
else if (new URL(url).origin === baseUrl) return url
return baseUrl
}References
This vulnerability was discovered right after https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw was published and is very similar in nature.
Read more about the callbacks.redirect option in the documentation: https://next-auth.js.org/configuration/callbacks#redirect-callback
For more information
If you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability
Timeline
The issue was reported 2022 April 20th, a response was sent out to the reporter 8 minutes after, and a patch was produced within a few days.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | next-auth | < 3.29.3, >= 4.0.0, < 4.3.3 | 3.29.3, 4.3.3 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-601- Platform
- npm
- Package
next-auth- Disclosed
- 24.05.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-q2mx-j4x2-2h74 - CC BY 4.0
Vulnerability history: next-auth
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 14
- First → latest
- 02.2021 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 4
- Medium 5
- Low 2
Disclosures per year
- 2021: 1
- 2022: 6
- 2023: 2
- 2024: 0
- 2025: 1
- 2026: 4
-
URL Redirection to Untrusted Site ('Open Redirect') in next-auth this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.