CVE-2022-31093

NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.

• CWE-754

• https://github.com/nextauthjs/next-auth/commit/25517b73153332d948114bacdff3b5908de91d85Patch, Third Party Advisory
• https://github.com/nextauthjs/next-auth/commit/e498483b23273d1bfc81be68339607f88d411bd6Patch, Third Party Advisory
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-g5fm-jp9v-2432Mitigation, Third Party Advisory
• https://next-auth.js.org/configuration/initialization#advanced-initializationVendor Advisory
• https://github.com/nextauthjs/next-auth/commit/25517b73153332d948114bacdff3b5908de91d85Patch, Third Party Advisory
• https://github.com/nextauthjs/next-auth/commit/e498483b23273d1bfc81be68339607f88d411bd6Patch, Third Party Advisory
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-g5fm-jp9v-2432Mitigation, Third Party Advisory
• https://next-auth.js.org/configuration/initialization#advanced-initializationVendor Advisory

Published

Jun 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31088LDAP Account Manager (LAM) is a webfrontend for managing ent…5.3
• CVE-2022-31089Parse Server is an open source backend that can be deployed …7.5
• CVE-2022-3109An issue was discovered in the FFmpeg package, where vp3_dec…7.5
• CVE-2022-31090Guzzle, an extensible PHP HTTP client. `Authorization` heade…7.7
• CVE-2022-31091Guzzle, an extensible PHP HTTP client. `Authorization` and `…7.7
• CVE-2022-31092Pimcore is an Open Source Data & Experience Management Platf…8.1
• CVE-2022-31094ScratchTools is a web extension designed to make interacting…6.1
• CVE-2022-31095discourse-chat is a chat plugin for the Discourse applicatio…6.5
• CVE-2022-31096Discourse is an open source discussion platform. Under certa…5.7
• CVE-2022-31097Grafana is an open-source platform for monitoring and observ…8.7
• CVE-2022-31098Weave GitOps is a simple open source developer platform for …7.5
• CVE-2022-31099rulex is a new, portable, regular expression language. When …6.5