NextAuth.js Email Provider HTML Injection Vulnerability

A vulnerability in the NextAuth.js email provider allows for HTML injection via the email signin endpoint. This issue affects NextAuth.js versions 3.x prior to 3.29.8 and 4.x prior to 4.9.0. An attacker can exploit this vulnerability by sending a crafted email address that includes malicious HTML. The email server then sends this HTML to the user, potentially leading to a phishing attack. For example, an attacker could send an email address formatted with a link to their site, and the email client would render it as a clickable link. This vulnerability has been addressed by updating the email handling to prevent such HTML from being rendered.

Impact

Exploitation of this vulnerability allows for HTML injection, which could be used for phishing attacks by tricking users into clicking links or providing information.

Reproduction

To reproduce this vulnerability, send a request to the NextAuth.js email signin endpoint with an email address that includes malicious HTML. The injected HTML will be rendered when the email is received, creating a phishing opportunity.

Remediation

Users can upgrade to NextAuth.js versions 3.29.8 or 4.9.0, both of which have patched this vulnerability. If an upgrade is not possible, the email parameter can be sanitized before being passed to the sendVerificationRequest function. For those using a custom sendVerificationRequest, it's important to either sanitize the email or exclude it from the HTML body.