CVE-2022-31093 (TypeScript, published 2022-06-27T22:15Z)
Description: value: NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/nextauthjs/next-auth
Files changed:
docs/docs/errors.md
packages/next-auth/src/core/errors.ts
packages/next-auth/src/core/index.ts
packages/next-auth/src/core/lib/assert.ts
packages/next-auth/src/core/lib/cookie.ts
Commit message: fix: handle invalid `callbackUrl`


Vulnerable code:
JSON Web Tokens are used for Sessions by default if you have not specified a database. However, if you are using a database, then Database Sessions are enabled by default and you need to [explicitly enable JWT Sessions](https://next-auth.js.org/configuration/options#session) to use the Credentials Provider.
https://next-auth.js.org/errors#jwt_session_error JWKKeySupport: the key does not support HS512 verify algorithm
In production, we expect you to define a `secret` property in your configuration. In development, this is shown as a warning for convenience. [Read more](https://next-auth.js.org/configuration/options#secret)
          if (error) signinUrl = `${signinUrl}&error=${encodeURIComponent(error)}`

Fixed code:
JSON Web Tokens are used for Sessions by default if you have not specified a database. However, if you are using a database, then Database Sessions are enabled by default and you need to [explicitly enable JWT Sessions](/configuration/options#session) to use the Credentials Provider.
#### INVALID_CALLBACK_URL_ERROR

The `callbackUrl` provided was either invalid or not defined. See [specifying a `callbackUrl`](/getting-started/client#specifying-a-callbackurl) for more information.

JWKKeySupport: the key does not support HS512 verify algorithm
In production, we expect you to define a `secret` property in your configuration. In development, this is shown as a warning for convenience. [Read more](/configuration/options#secret)
export class InvalidCallbackUrl extends UnknownError {
  name = "InvalidCallbackUrl"
  code = "INVALID_CALLBACK_URL_ERROR"
}

          if (error)
            signinUrl = `${signinUrl}&error=${encodeURIComponent(error)}`
  InvalidCallbackUrl,
import parseUrl from "../../lib/parse-url"
import { defaultCookies } from "./cookie"
function isValidHttpUrl(url: string) {
  try {
    return /^https?:/.test(new URL(url).protocol)
  } catch {
    return false
  }
}

  const callbackUrlParam = req.query?.callbackUrl as string | undefined

  if (callbackUrlParam && !isValidHttpUrl(callbackUrlParam)) {
    return new InvalidCallbackUrl(
      `Invalid callback URL. Received: ${callbackUrlParam}`
    )
  }

  const url = parseUrl(req.host)

  const { callbackUrl: defaultCallbackUrl } = defaultCookies(
    options.useSecureCookies ?? url.base.startsWith("https://")
  )
  const callbackUrlCookie =
    req.cookies?.[options.cookies?.callbackUrl?.name ?? defaultCallbackUrl.name]

  if (callbackUrlCookie && !isValidHttpUrl(callbackUrlCookie)) {
    return new InvalidCallbackUrl(
      `Invalid callback URL. Received: ${callbackUrlCookie}`
    )
  }

        httpOnly: true,