NextAuth.js OAuth State Cookie Mismatch Vulnerability (CVE-2025-73419)

Vulnerability Overview OAuth state, nonce, and PKCE validation cookies are not bound to the provider that created them. Affected Versions Affected Versions: - (npm): = 5.0.0-beta.1, = 5.0.0-beta.1, <= 5.0.0-beta.31 or <= 0.41.2, have multiple OAuth/OIDC providers configured, allow users to link additional providers after login, have at least one configured provider's authorization request observable by an attacker, and have at least one target provider's callback completable without PKCE validation (i.e., it relies solely on or solely on ). When you are not affected: - You are not affected if you use a single OAuth provider, do not allow account linking after login, or all providers enforce PKCE. Impact: - Account Linking Confusion: An attacker can link their account to the victim's Auth.js user, granting persistent login to the victim's account via the linked provider. - Exploitation requires the victim to initiate a legitimate flow from the same origin; it cannot be performed via Cross-Site Request Forgery (CSRF), which reduces the likelihood of successful exploitation. CWE-345: Insufficient Verification of Data Authenticity; CWE-346: Origin Validation Error; CWE-940: Improper Verification of Communication Channel Source. Patch Details: - The fix binds OAuth validation cookies to the provider/authorization flow that created them, so callbacks cannot consume validation values mined for different providers. Workarounds: - If you cannot upgrade immediately: - Enable PKCE (validating , as well as / ) on every provider that supports it. PKCE prevents the actual code exchange variant because the attacker cannot observe the relying party's validator. - Avoid linking already logged-in accounts across multiple providers where one provider is low-trust or observable by an attacker. - Handle the event: add audit logs, user notifications, or out-of-band confirmation sensitively to make any unexpected links visible (defense in depth, not a root cause fix). Credit: - Reported by @Nadav077. Thank you for responsible disclosure.

Goal Reached Thanks to every supporter — we hit 100%!

NextAuth.js OAuth State Cookie Mismatch Vulnerability (CVE-2025-73419)

More from this source