{"action":"Upgrade next-auth to 3.29.10 or later.","affected":[{"fixed":"4.10.3","introduced":"4.0.0"},{"fixed":"3.29.10","introduced":"0"}],"component":"next-auth","cve_ids":["CVE-2022-35924"],"ecosystem":"npm","epss":0.01471,"exploited":false,"fixed_versions":["4.10.3","3.29.10"],"ghsa_id":"GHSA-xv97-c62v-4587","id":"tcs_01M5KGJX361C793MF8TAP2Z93M","modified_at":"2023-11-08T04:09:52.914769Z","published_at":"2022-08-02T18:00:33Z","references":["https://osv.dev/vulnerability/GHSA-xv97-c62v-4587","https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xv97-c62v-4587","https://nvd.nist.gov/vuln/detail/CVE-2022-35924","https://github.com/nextauthjs/next-auth/commit/afb1fcdae3cc30445038ef588e491d139b916003","https://en.wikipedia.org/wiki/Email_address#Local-part","https://github.com/nextauthjs/next-auth","https://next-auth.js.org/configuration/callbacks#sign-in-callback","https://next-auth.js.org/configuration/initialization#advanced-initialization","https://next-auth.js.org/providers/email","https://next-auth.js.org/providers/email#normalizing-the-e-mail-address","https://next-auth.js.org/providers/email#normalizing-the-email-address","https://nodemailer.com/message/addresses"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-xv97-c62v-4587","url":"https://osv.dev/vulnerability/GHSA-xv97-c62v-4587"}],"summary":"NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails"}