Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nextauthjs/next-auth

              main @ 7b35fc3
            

Fixes

CVEs

CRITICAL

Peak severity

54.3%

Coverage

Highlights

Auth Bypass: 38 prior fixes. Scrutinize any change in this area.

src/server/index.js: most-fixed (10 issues). Treat as high-risk during review.

48 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The Upstash Redis adapter was historically vulnerable to verification token bypasses because database checks validated only the email identifier without checking the actual token value. Developers must ensure all authentication adapter lookups verify the complete token payload.

Email Injection: Email input processing lacked robust normalization (such as NFKC normalization and splitting characters), allowing address-parser confusion and email-forging attacks via homoglyphs or comma-separated lists.

Auth Bypass: Failure to bind security check cookies (state, nonce, PKCE) to their creating provider allowed cross-provider authentication bypasses and OAuth session hijacking.