NextAuth.js default redirect callback vulnerable to open redirects
next-auth v3 users before version 3.29.2 are impacted. (We recommend upgrading to v4 in most cases. See our migration guide).next-auth v4 users before version 4.3.2 are impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option:
// async redirect(url, baseUrl) { // v3
async redirect({ url, baseUrl }) { // v4
// Allows relative callback URLs
if (url.startsWith("/")) return new URL(url, baseUrl).toString()
// Allows callback URLs on the same origin
else if (new URL(url).origin === baseUrl) return url
return baseUrl
}If you already have a redirect callback, make sure that you match the incoming url origin against the baseUrl.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | next-auth | < 3.29.2, >= 4.0.0, < 4.3.2 | 3.29.2, 4.3.2 |
References
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw
- https://nvd.nist.gov/vuln/detail/CVE-2022-24858
- https://github.com/nextauthjs/next-auth/commit/6e15bdcb2d93c1ad5ee3889f702607637e79db50
- https://github.com/nextauthjs/next-auth
- https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.3.2
- https://next-auth.js.org/configuration/callbacks#redirect-callback
- https://next-auth.js.org/getting-started/upgrade-v4
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N- Weakness (CWE)
CWE-290, CWE-601- Platform
- npm
- Package
next-auth- Disclosed
- 22.04.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-f9wg-5f46-cjmw - CC BY 4.0
Vulnerability history: next-auth
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 14
- First → latest
- 02.2021 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 4
- Medium 5
- Low 2
Disclosures per year
- 2021: 1
- 2022: 6
- 2023: 2
- 2024: 0
- 2025: 1
- 2026: 4
-
NextAuth.js default redirect callback vulnerable to open redirects this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.