CVE-2022-24858

    Dashboard / Vulnerabilities / CVE-2022-24858

    CVE-2022-24858

    Published: 19 Apr 2022Last Modified: 21 Oct 2026

    Summary: Default redirect callback vulnerable to open redirects

    Details: next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.

    References: https://next-auth.js.org/configuration/callbacks#redirect-callback, https://next-auth.js.org/getting-started/upgrade-v4, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24858.json, https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw, https://nvd.nist.gov/vuln/detail/CVE-2022-24858

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 29b67b664785ba086008159e69c5e22969f69b48
    Fixed -430aa4855779c22c1ae7406a5da2a258274429e3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24858 | CVE-DB