Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@next-auth/upstash-redis-adapter

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.8npmAmendedPublished

    Upstash Adapter missing token verification

    CVE-2022-39263 · GHSA-4rxr-27mm-mxq9

    Affected
    • npm @next-auth/upstash-redis-adapter < 3.0.2
    Fixed in
    3.0.2· Vendor fix available
    Issue
    Impact Applications that use next-auth Email Provider and @next-auth/upstash-redis-adapter before v3.0.2 are affected. Description The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. Patches The vulnerability is patched in v3.0.2. To upgrade, run one of the following: Workarounds Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding. Below is an example of how to do this: (Upgrading is still strongly recommended) References EmailProvider: https://next-auth.js.org/providers/email Advanced Initialization: https://next-auth.js.org/configuration/initialization#advanced-initialization Upstash Redis Adapter:…

    Recommended action: Upgrade to 3.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →