QID 982944

QID 982944: Nodejs (npm) Security Update for next-auth (GHSA-pg53-56cg-4m8q)

The Prisma database adapter was checking the verification token but not the identifier (the email address associated with the token). This made it possible to use a valid token assigned to one user, to sign in as another user when using the Prima adapter in conjunction with the Email provider. The defect is specific to the community-supported Prisma database adapter in versions <3.3.0 and is not present in the default database adapter (TypeORM).

*Note: The current community-supported adapter was not developed by Prisma.*

The defect was a problem in the implementation of verification function the adapter and is not directly related to Prisma.

The flaw may exist in other third party database adapters that do not check both the identifier and token values.

The design of the database adapter API may be revised in future to help reduce the likelyhood of similar defects.

Implementations using the **Prisma database adapter** with the **Email provider** **are impacted**.

Implementations using the Prisma database adapter that are not using the Email provider are not impacted.
Implementations using the default database adapter (TypeORM) with the Email provider are not impacted.
Implementations not using a database are not impacted.

CVSS V3 rated as Medium - 5.9 severity.

CVSS V2 rated as Medium - 4.3 severity.

Solution

This issue is fixed in 3.3.0 and newer versions.Workaround:
Those not able to upgrade can alternatively disable the Email provider as a workaround.

Vendor References

GHSA-pg53-56cg-4m8q - github.com/advisories/GHSA-pg53-56cg-4m8q

CVEs related to QID 982944

CVE-2021-21310 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-pg53-56cg-4m8q	next-auth		github.com/advisories/GHSA-pg53-56cg-4m8q

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].