NextAuth.js Improper Callback URL Handling Vulnerability

A vulnerability exists in NextAuth.js, an authentication solution for Next.js applications, in versions prior to 3.29.5 and 4.5.0. The issue arises when an attacker sends a request with an invalid 'callbackUrl' query parameter. This malformed URL fails during the URL object creation, leading to an unhandled error. Consequently, the API route handler times out, causing the login process to fail. This vulnerability has been patched in NextAuth.js versions 3.29.5 and 4.5.0.

Impact

Exploitation of this vulnerability causes the API route handler to time out, leading to failed login attempts.

Reproduction

To reproduce this vulnerability, send a request to an application using NextAuth.js with an invalid 'callbackUrl' query parameter. The server will respond with a 500 status code, indicating a server error. This behavior can be tested using a tool like Postman or by writing a script that sends HTTP requests with the malformed 'callbackUrl'.

Remediation

Users can upgrade to NextAuth.js versions 3.29.5 or 4.5.0 to address this vulnerability. If an upgrade is not possible, the vulnerability can be mitigated by using 'Advanced Initialization' to validate the 'callbackUrl' before it is processed by NextAuth.js.