What’s Vulnerable › Vulnerabilities

CVE-2021-21310: Token verification bug in next-auth

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-02-11 · updated 2026-06-17
• Weakness: CWE-290

Description

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider are impacted. Implementations using the Email provider with the default database adapter are not impacted. Implementations using the Prisma database adapter but not using the Email provider are not impacted. The Prisma database adapter was checking the verification token, but was not verifying the email address associated with that token. This made it possible to use a valid token to sign in as another user when using the Prima adapter in conjunction with the Email provider. This issue is specific to the community supported Prisma adapter. This issue is fixed in version 3.3.0.

Affected products

• nextauthjs next-auth: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: nextauthjs next-auth 3.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/nextauthjs/next-auth/releases/tag/v3.3.0
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q
• https://www.npmjs.com/package/next-auth
• https://github.com/nextauthjs/next-auth/releases/tag/v3.3.0
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q
• https://www.npmjs.com/package/next-auth

Get alerted when CVE-2021-21310 or the next vulnerability affects your stack