CVE-2021-21310 — MEDIUM (6.1)

Q: How severe is CVE-2021-21310?

CVE-2021-21310 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2021-21310?

Check the references section above for vendor advisories and patch information. Affected products include: Nextauth.Js Next-Auth.

Vulnerability Description

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider are impacted. Implementations using the Email provider with the default database adapter are not impacted. Implementations using the Prisma database adapter but not using the Email provider are not impacted. The Prisma database adapter was checking the verification token, but was not verifying the email address associated with that token. This made it possible to use a valid token to sign in as another user when using the Prima adapter in conjunction with the Email provider. This issue is specific to the community supported Prisma adapter. This issue is fixed in version 3.3.0.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Nextauth.Js	Next-Auth	< 3.3.0

Related Weaknesses (CWE)

CWE-290

References

https://github.com/nextauthjs/next-auth/releases/tag/v3.3.0Third Party Advisory
https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8qExploitThird Party Advisory
https://www.npmjs.com/package/next-authProductThird Party Advisory
https://github.com/nextauthjs/next-auth/releases/tag/v3.3.0Third Party Advisory
https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8qExploitThird Party Advisory
https://www.npmjs.com/package/next-authProductThird Party Advisory

FAQ

What is CVE-2021-21310?

CVE-2021-21310 is a vulnerability with a CVSS score of 6.1 (MEDIUM). NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Pri...

How severe is CVE-2021-21310?

CVE-2021-21310 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-21310?

Check the references section above for vendor advisories and patch information. Affected products include: Nextauth.Js Next-Auth.