Summary
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Auth.js stores the OAuth/OIDC anti-CSRF checks (state, nonce, and the PKCE verifier) in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider, because the stored cookie is not verified against the callback provider's identity (provider id, issuer, client id, or redirect URI). In a multi-provider app that allows account linking while logged in, this provider-confusion / mix-up condition can let an attacker link their account at a second provider to a victim's user.
Am I affected?
You may be affected if all of the following hold:
- You use
next-auth<= 4.24.14or>= 5.0.0-beta.1, <= 5.0.0-beta.31, or@auth/core<= 0.41.2. - You configure multiple OAuth/OIDC providers.
- You allow users to link additional providers while logged in.
- At least one configured provider's authorization request is observable by an attacker, and at least one target provider's callback can be satisfied without a PKCE verifier (i.e. it relies only on
stateor only onnonce).
You are not affected if you use a single OAuth provider, do not allow logged-in account linking, or all providers enforce PKCE.
Patched version
The fix binds the OAuth check cookies to the provider/authorization flow that created them, so a callback cannot consume a check value minted for a different provider. Upgrade to the first releases containing this fix (pending; this advisory will be updated with exact patched versions before publication).
Workarounds
If you cannot upgrade immediately:
- Enable PKCE (
checks: ["pkce"], in addition tostate/nonce) on every provider that supports it; PKCE blocks the practical code-swap variant because the attacker cannot observe the relying party's verifier. - Avoid offering logged-in account linking across multiple providers where one provider is lower-trust or attacker-observable.
- Treat
events.linkAccountas sensitive: add audit logging, user notification, or out-of-band confirmation so that any unexpected link is visible (defense-in-depth, not a root-cause fix).
Credit
Reported by @Nadav0077. Thank you for the responsible disclosure.
Impact
- Account-linking confusion: an attacker can get their account at a target provider linked to the victim's Auth.js user, granting the attacker persistent sign-in to the victim's account through that linked provider.
- Exploitation requires luring the victim into starting a legitimate same-origin flow; it cannot be performed by cross-site request forgery alone, which reduces practical likelihood.
GHSA-X445-F3H2-J279 has a CVSS score of 6.8 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.41.3, 5.0.0-beta.32, 4.24.15); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
@auth/core to 0.41.3 or later; next-auth to 5.0.0-beta.32 or later; next-auth to 4.24.15 or later
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-X445-F3H2-J279? GHSA-X445-F3H2-J279 is a medium-severity security vulnerability in @auth/core (npm), affecting versions <= 0.41.2. It is fixed in 0.41.3, 5.0.0-beta.32, 4.24.15.
- How severe is GHSA-X445-F3H2-J279? GHSA-X445-F3H2-J279 has a CVSS score of 6.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which packages are affected by GHSA-X445-F3H2-J279?
@auth/core(npm) (versions <= 0.41.2)next-auth(npm) (versions >= 5.0.0-beta.1, <= 5.0.0-beta.31)
- Is there a fix for GHSA-X445-F3H2-J279? Yes. GHSA-X445-F3H2-J279 is fixed in 0.41.3, 5.0.0-beta.32, 4.24.15. Upgrade to this version or later.
- Is GHSA-X445-F3H2-J279 exploitable, and should I be worried? Whether GHSA-X445-F3H2-J279 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-X445-F3H2-J279 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-X445-F3H2-J279?
- Upgrade
@auth/coreto 0.41.3 or later - Upgrade
next-authto 5.0.0-beta.32 or later - Upgrade
next-authto 4.24.15 or later
- Upgrade