NextAuth.js, a library providing authentication for Next.js, prior to versions @auth/core 0.41.3, next-auth 4.24.15, and 5.0.0-beta.32, stores OAuth/OIDC anti-CSRF state, nonce, and PKCE verifier values in global cookies that are not bound to the specific provider that created them. Consequently, during the OAuth callback, a value minted for one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity attributes such as provider ID, issuer, client ID, or redirect URI. In multi-provider applications that allow account linking while logged in, this flaw can be exploited by an attacker who observes one provider's authorization request and then uses a target provider callback without a PKCE verifier to link their account to the victim's Auth.js user account. This linked provider then grants the attacker persistent sign-in access to the victim's account. The vulnerability is identified as CWE-345 (Insufficient Verification of Data Authenticity) and related CWEs. The issue is fixed in the specified patched versions.

The vulnerability allows an attacker to link their own account to a victim's user account in multi-provider authentication setups with account linking enabled. This results in persistent unauthorized access to the victim's account via the linked provider. The CVSS score of 6.8 (medium severity) reflects the network attack vector, high impact on confidentiality and integrity, but requires user interaction and has high attack complexity.

A fix is available in @auth/core version 0.41.3 and next-auth versions 4.24.15 and 5.0.0-beta.32. Users of affected versions should upgrade to these or later versions to remediate the vulnerability. No alternative mitigations are indicated in the advisory.