Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-3mbu-vdqr-5yaz
Summary
Session Fixation
NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to **log in as the victim**, bypassing the CSRF protection. This is due to a partial failure during a compromised OAuth session where a session code is erroneously generated. This issue has been addressed in version 4.20.1. Users are advised to upgrade. Users unable to upgrade may using Advanced Initialization, manually check the callback request for state, pkce, and nonce against the provider configuration to prevent this issue. See the linked GHSA for details.
Aliases
0
alias CVE-2023-27490
1
alias GHSA-7r7x-4c4q-c4qf
Fixed_packages
0
url pkg:npm/next-auth@4.20.1
purl pkg:npm/next-auth@4.20.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next-auth@4.20.1
Affected_packages
References
0
reference_url https://authjs.dev/reference/core/providers#checks
reference_id
reference_type
scores
url https://authjs.dev/reference/core/providers#checks
1
reference_url https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/
reference_id
reference_type
scores
url https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/
2
reference_url https://github.com/nextauthjs/next-auth/compare/next-auth@4.20.0...next-auth@4.20.1#diff-cf9257195d0cb6a835ae4ff1fc73fe2cac0bab847efb0832c1f551209a972b47R55
reference_id
reference_type
scores
url https://github.com/nextauthjs/next-auth/compare/next-auth@4.20.0...next-auth@4.20.1#diff-cf9257195d0cb6a835ae4ff1fc73fe2cac0bab847efb0832c1f551209a972b47R55
3
reference_url https://next-auth.js.org/configuration/initialization#advanced-initialization
reference_id
reference_type
scores
url https://next-auth.js.org/configuration/initialization#advanced-initialization
4
reference_url https://next-auth.js.org/configuration/providers/oauth
reference_id
reference_type
scores
url https://next-auth.js.org/configuration/providers/oauth
5
reference_url https://www.rfc-editor.org/rfc/rfc6749#section-10.12
reference_id
reference_type
scores
url https://www.rfc-editor.org/rfc/rfc6749#section-10.12
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-27490
reference_id CVE-2023-27490
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-27490
7
reference_url https://github.com/advisories/GHSA-7r7x-4c4q-c4qf
reference_id GHSA-7r7x-4c4q-c4qf
reference_type
scores
url https://github.com/advisories/GHSA-7r7x-4c4q-c4qf
8
reference_url https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf
reference_id GHSA-7r7x-4c4q-c4qf
reference_type
scores
url https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 352
name Cross-Site Request Forgery (CSRF)
description The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
Severity_range_scorenull
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-3mbu-vdqr-5yaz