CVE-2021-21310

Public Exploit
Token verification bug in next-auth

Description

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider are impacted. Implementations using the Email provider with the default database adapter are not impacted. Implementations using the Prisma database adapter but not using the Email provider are not impacted. The Prisma database adapter was checking the verification token, but was not verifying the email address associated with that token. This made it possible to use a valid token to sign in as another user when using the Prima adapter in conjunction with the Email provider. This issue is specific to the community supported Prisma adapter. This issue is fixed in version 3.3.0.

Category

6.1
CVSS
Severity: Medium
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.30%
Third-Party Advisory github.com Third-Party Advisory github.com Third-Party Advisory npmjs.com
Affected: nextauthjs next-auth
Published at:
Updated at:

References

Link Tags
https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pg53-56cg-4m8q third party advisory exploit
https://www.npmjs.com/package/next-auth third party advisory product
https://github.com/nextauthjs/next-auth/releases/tag/v3.3.0 third party advisory

Frequently Asked Questions

What is the severity of CVE-2021-21310?
CVE-2021-21310 has been scored as a medium severity vulnerability.
How to fix CVE-2021-21310?
To fix CVE-2021-21310, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2021-21310 being actively exploited in the wild?
It is possible that CVE-2021-21310 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2021-21310?
CVE-2021-21310 affects nextauthjs next-auth.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.