Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-899c-99vb-v7bc
|
NextAuthjs Email misdelivery Vulnerability
NextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in `nodemailer`'s address parser used by the project (fixed in `nodemailer` **v7.0.7**). A crafted input such as:
```
"e@attacker.com"@victim.com
```
is parsed incorrectly and results in the message being delivered to `e@attacker.com` (attacker) instead of `"<e@attacker.com>@victim.com"` (the intended recipient at `victim.com`) in violation of RFC 5321/5322 semantics. This allows an attacker to receive login/verification links or other sensitive emails intended for the victim.
<h2>Affected NextAuthjs Version</h2>
≤ Version | Afftected
-- | --
4.24.11 | Yes
5.0.0-beta.29 | Yes
|
GHSA-5jpx-9hw9-2fx4
|