CVE-2022-31093

    Dashboard / Vulnerabilities / CVE-2022-31093

    CVE-2022-31093

    Published: 27 Jun 2022Last Modified: 12 Aug 2026

    Summary: Improper Handling of `callbackUrl` parameter in next-auth

    Details: NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.

    References: https://next-auth.js.org/configuration/initialization#advanced-initialization, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31093.json, https://github.com/nextauthjs/next-auth/security/advisories/GHSA-g5fm-jp9v-2432, https://nvd.nist.gov/vuln/detail/CVE-2022-31093, https://github.com/nextauthjs/next-auth/commit/25517b73153332d948114bacdff3b5908de91d85, https://github.com/nextauthjs/next-auth/commit/e498483b23273d1bfc81be68339607f88d411bd6

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 29b67b664785ba086008159e69c5e22969f69b48
    Fixed -8c5d9faad65931e478147412fd905bdd70aa0a4c

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31093 | CVE-DB