-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| next-auth | npm | < 3.29.9 | 3.29.9 |
| next-auth | npm | >= 4.0.0, < 4.10.2 | 4.10.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from provider configuration details (including secrets) being logged during OAuth error handling at the error log level. The patch moved these logs to debug level and warned against debug mode in production. The workaround explicitly shows sanitization of 'metadata.provider' in error logs, confirming the error logging path was leaking provider data. While exact file paths aren't provided in advisory details, the pattern matches core OAuth error handling logic where provider configuration would be present during authentication flows.
JavaScriptJavaScriptRelated documentation:
If you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability
The issue was reported 18th of July, a response was sent out in less than 20 minutes and after identifying the issue a patch was published within a week.
Ongoing coverage of React2Shell