{"action":"Upgrade next-auth to 4.20.1 or later.","affected":[{"fixed":"4.20.1","introduced":"0"}],"component":"next-auth","cve_ids":["CVE-2023-27490"],"ecosystem":"npm","epss":0.00538,"exploited":false,"fixed_versions":["4.20.1"],"ghsa_id":"GHSA-7r7x-4c4q-c4qf","id":"tcs_01M5KFASJFHX9RZJT2VYKTPKKF","modified_at":"2026-09-10T03:49:52.759065460Z","published_at":"2023-03-13T20:52:50Z","references":["https://osv.dev/vulnerability/GHSA-7r7x-4c4q-c4qf","https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7r7x-4c4q-c4qf","https://nvd.nist.gov/vuln/detail/CVE-2023-27490","https://authjs.dev/reference/core/providers#checks","https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not","https://github.com/nextauthjs/next-auth","https://github.com/nextauthjs/next-auth/compare/next-auth@4.20.0...next-auth@4.20.1#diff-cf9257195d0cb6a835ae4ff1fc73fe2cac0bab847efb0832c1f551209a972b47R55","https://next-auth.js.org/configuration/initialization#advanced-initialization","https://next-auth.js.org/configuration/providers/oauth","https://security.netapp.com/advisory/ntap-20230420-0006","https://www.rfc-editor.org/rfc/rfc6749#section-10.12"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-7r7x-4c4q-c4qf","url":"https://osv.dev/vulnerability/GHSA-7r7x-4c4q-c4qf"}],"summary":"Missing proper state, nonce and PKCE checks for OAuth authentication"}