NextAuth.js Email Provider Vulnerability in Sign-In Process

A vulnerability exists in NextAuth.js versions prior to 4.10.3 and 3.29.10, specifically within the EmailProvider. When an attacker sends a comma-separated list of emails to the sign-in endpoint, both the attacker's and the victim's email addresses receive verification emails. This allows the attacker to log in as a new user with an email address combining both addresses, bypassing authorization checks that rely on email domains.

Impact

Exploitation of this vulnerability allows attackers to create accounts and log in using email addresses of their choosing, potentially bypassing domain-based authorization checks.

Reproduction

To reproduce this vulnerability, send a request to the NextAuth.js sign-in endpoint with the EmailProvider, including a comma-separated list of email addresses. The default behavior will be to send verification emails to both addresses. Once the verification link is clicked, NextAuth.js will log in the user with a normalized email address that combines both emails.

Remediation

Users can upgrade to NextAuth.js versions 4.10.3 or 3.29.10, where this vulnerability has been patched. If an upgrade is not possible, the incoming email requests can be normalized using the 'normalizeIdentifier' method in the EmailProvider configuration.