CVE-2022-24858

next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.

• CWE-290
• CWE-601

• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmwMitigation, Third Party Advisory
• https://next-auth.js.org/configuration/callbacks#redirect-callbackVendor Advisory
• https://next-auth.js.org/getting-started/upgrade-v4Vendor Advisory
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmwMitigation, Third Party Advisory
• https://next-auth.js.org/configuration/callbacks#redirect-callbackVendor Advisory
• https://next-auth.js.org/getting-started/upgrade-v4Vendor Advisory

Published

Apr 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24851LDAP Account Manager (LAM) is an open source web frontend fo…4.8
• CVE-2022-24853Metabase is an open source business intelligence and analyti…5.3
• CVE-2022-24854Metabase is an open source business intelligence and analyti…8.8
• CVE-2022-24855Metabase is an open source business intelligence and analyti…5.4
• CVE-2022-24856FlyteConsole is the web user interface for the Flyte platfor…7.5
• CVE-2022-24857django-mfa3 is a library that implements multi factor authen…8.8
• CVE-2022-24859PyPDF2 is an open source python PDF library capable of split…5.5
• CVE-2022-2486A vulnerability, which was classified as critical, was found…9.8
• CVE-2022-24860Databasir is a team-oriented relational database model docum…9.8
• CVE-2022-24861Databasir is a team-oriented relational database model docum…8.8
• CVE-2022-24862Databasir is a team-oriented relational database model docum…7.7
• CVE-2022-24863http-swagger is an open source wrapper to automatically gene…7.5