NextAuth.js Prisma Adapter Email Provider Token Verification Vulnerability

A vulnerability exists in NextAuth.js versions prior to 3.3.0 when the Prisma database adapter is used with the Email provider. The issue arises because the Prisma adapter verifies the token but fails to validate the associated email address. This flaw allows a valid token from one user to be used to sign in as another user. The vulnerability is not present in implementations using the default database adapter or those that do not use a database.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts by bypassing email verification requirements, potentially leading to account takeover.

Remediation

Users can upgrade to NextAuth.js version 3.3.0 or later to address this vulnerability. Those unable to upgrade can disable the Email provider as an alternative workaround.