Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-7pmm-9rk3-gka2
Vulnerability ID VCID-7pmm-9rk3-gka2
Aliases CVE-2022-24858
GHSA-f9wg-5f46-cjmw
Summary next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-290 Authentication Bypass by Spoofing
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00318 https://api.first.org/data/v1/epss?cve=CVE-2022-24858
epss 0.00318 https://api.first.org/data/v1/epss?cve=CVE-2022-24858
epss 0.00318 https://api.first.org/data/v1/epss?cve=CVE-2022-24858
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-f9wg-5f46-cjmw
cvssv3.1 6.1 https://github.com/nextauthjs/next-auth
generic_textual MODERATE https://github.com/nextauthjs/next-auth
cvssv3.1 6.1 https://github.com/nextauthjs/next-auth/commit/6e15bdcb2d93c1ad5ee3889f702607637e79db50
generic_textual MODERATE https://github.com/nextauthjs/next-auth/commit/6e15bdcb2d93c1ad5ee3889f702607637e79db50
cvssv3.1 6.1 https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.3.2
generic_textual MODERATE https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.3.2
cvssv3.1 6.1 https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw
cvssv3.1_qr MODERATE https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw
generic_textual MODERATE https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw
ssvc Track https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw
cvssv3.1 6.1 https://next-auth.js.org/configuration/callbacks#redirect-callback
generic_textual MODERATE https://next-auth.js.org/configuration/callbacks#redirect-callback
ssvc Track https://next-auth.js.org/configuration/callbacks#redirect-callback
cvssv3.1 6.1 https://next-auth.js.org/getting-started/upgrade-v4
generic_textual MODERATE https://next-auth.js.org/getting-started/upgrade-v4
ssvc Track https://next-auth.js.org/getting-started/upgrade-v4
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2022-24858
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-24858
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-24858
https://github.com/nextauthjs/next-auth
https://github.com/nextauthjs/next-auth/commit/6e15bdcb2d93c1ad5ee3889f702607637e79db50
https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.3.2
callbacks#redirect-callback https://next-auth.js.org/configuration/callbacks#redirect-callback
CVE-2022-24858 https://nvd.nist.gov/vuln/detail/CVE-2022-24858
GHSA-f9wg-5f46-cjmw https://github.com/advisories/GHSA-f9wg-5f46-cjmw
GHSA-f9wg-5f46-cjmw https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw
upgrade-v4 https://next-auth.js.org/getting-started/upgrade-v4
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N Found at https://github.com/nextauthjs/next-auth
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N Found at https://github.com/nextauthjs/next-auth/commit/6e15bdcb2d93c1ad5ee3889f702607637e79db50
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N Found at https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.3.2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N Found at https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:08:09Z/ Found at https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N Found at https://next-auth.js.org/configuration/callbacks#redirect-callback
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:08:09Z/ Found at https://next-auth.js.org/configuration/callbacks#redirect-callback
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N Found at https://next-auth.js.org/getting-started/upgrade-v4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:08:09Z/ Found at https://next-auth.js.org/getting-started/upgrade-v4
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-24858
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.55304
EPSS Score 0.00318
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:41:13.351904+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2022/24xxx/CVE-2022-24858.json 38.6.0