CVE-2021-21310 Details
Description
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider are impacted. Implementations using the Email provider with the default database adapter are not impacted. Implementations using the Prisma database adapter but not using the Email provider are not impacted. The Prisma database adapter was checking the verification token, but was not verifying the email address associated with that token. This made it possible to use a valid token to sign in as another user when using the Prima adapter in conjunction with the Email provider. This issue is specific to the community supported Prisma adapter. This issue is fixed in version 3.3.0.
A vulnerability exists in NextAuth.js versions prior to 3.3.0 when the Prisma database adapter is used with the Email provider. The issue arises because the Prisma adapter verifies the token but fails to validate the associated email address. This flaw allows a valid token from one user to be used to sign in as another user. The vulnerability is not present in implementations using the default database adapter or those that do not use a database.
Users can upgrade to NextAuth.js version 3.3.0 or later to address this vulnerability. Those unable to upgrade can disable the Email provider as an alternative workaround.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nextauthjs/next-auth/releases/tag/v3.3.0 | CVE | Third Party Advisory |
| https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q | CVE | ExploitThird Party Advisory |
| https://www.npmjs.com/package/next-auth | CVE | ProductThird Party Advisory |
| https://github.com/nextauthjs/next-auth/releases/tag/v3.3.0 | [email protected] | Third Party Advisory |
| https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q | [email protected] | ExploitThird Party Advisory |
| https://www.npmjs.com/package/next-auth | [email protected] | ProductThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nextauth.js next-auth | < 3.3.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Feb 19, 2021 | Initial Analysis | [email protected] |