Skip to content
Heist/ feed
Back to feed
Low

Leakage of excessive information into log in next-auth

Type: advisorySources: OSV

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2022-31186
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 03:06 UTC · Revision 1

Source evidence

Leakage of excessive information into log in next-auth

core-osv · Original source

Published 1 Aug 2022, 19:25 UTC

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.

osv:CVE-2022-31186
Complete source record
{
  "id": "a72c61fd85681a111cc1261d09310f98d87027696f0e47f63469f2499b2f1cdc",
  "url": "https://osv.dev/vulnerability/CVE-2022-31186",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Leakage of excessive information into log in next-auth",
    "summary": "NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs.",
    "evidence": "osv:CVE-2022-31186",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2022-31186",
      "aliases": [
        "CVE-2022-31186",
        "GHSA-p6mm-27gq-9v3p"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nextauthjs/next-auth",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "29db75ad28f078397393bd5efac759d7a1a6cfe3"
                },
                {
                  "introduced": "29b67b664785ba086008159e69c5e22969f69b48"
                },
                {
                  "fixed": "6590993fdc4ad31d5ce4b9dc3f5ca9df5d72b793"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:next-auth:nextauth.js:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.29.9"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:next-auth:nextauth.js:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "4.0.0"
                      },
                      {
                        "fixed": "4.10.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "next-auth@v4.10.1",
            "next-auth@v4.10.0",
            "@next-auth/typeorm-legacy-adapter@v2.0.0",
            "@next-auth/sequelize-adapter@v1.0.5",
            "@next-auth/firebase-adapter@v1.0.0",
            "next-auth@v4.9.0",
            "next-auth@v4.8.0",
            "next-auth@v4.6.1",
            "next-auth@v4.5.0",
            "next-auth@v4.3.4",
            "next-auth@v4.3.3",
            "v3.29.1",
            "next-auth@v4.3.1",
            "next-auth@v4.3.0",
            "@next-auth/typeorm-legacy-adapter@v1.0.2",
            "@next-auth/prisma-adapter@v1.0.2",
            "@next-auth/mongodb-adapter@v1.0.2",
            "@next-auth/mikro-orm-adapter@v2.0.0",
            "v3.29.0",
            "v4.2.1",
            "v4.2.0",
            "v4.1.2",
            "v4.1.1",
            "v4.1.0",
            "v4.0.6",
            "v4.0.5",
            "v4.0.4",
            "v4.0.3",
            "v4.0.2",
            "v4.0.1",
            "v3.28.0",
            "v3.27.3",
            "v3.27.2",
            "v3.27.1",
            "v3.27.0",
            "v3.26.1",
            "v3.26.0",
            "v3.25.0",
            "v3.24.1",
            "v3.24.0",
            "v3.23.3",
            "v3.23.2",
            "v3.23.1",
            "v3.23.0",
            "v3.22.0",
            "v3.21.1",
            "v3.21.0",
            "v3.20.1",
            "v3.20.0",
            "v3.19.8",
            "v3.19.7",
            "v3.19.6",
            "v3.19.5",
            "v3.19.4",
            "v3.19.3",
            "v3.19.2",
            "v3.19.1",
            "v3.19.0",
            "v3.18.2",
            "v3.18.1",
            "v3.18.0",
            "v3.17.2",
            "v3.17.1",
            "v3.17.0",
            "v3.16.1",
            "v3.16.0",
            "v3.15.13",
            "v3.15.12",
            "v3.15.11",
            "v3.15.10",
            "v3.15.9",
            "v3.15.8",
            "v3.15.7",
            "v3.15.6",
            "v3.15.5",
            "v3.15.4",
            "v3.15.3",
            "v3.15.2",
            "v3.15.1",
            "v3.15.0",
            "v3.14.8",
            "v3.14.7",
            "v3.14.6",
            "v3.14.5",
            "v3.14.4",
            "v3.14.3",
            "v3.14.2",
            "v3.14.1",
            "v3.14.0",
            "v3.13.3",
            "v3.13.2",
            "v3.13.1",
            "v3.13.0",
            "v3.12.0",
            "v3.11.2",
            "v3.11.1",
            "v3.11.0",
            "v3.10.1",
            "v3.10.0",
            "v3.9.0",
            "v3.8.0",
            "v3.7.1",
            "v3.7.0",
            "v3.6.1",
            "v3.6.0",
            "v3.5.1",
            "v3.5.0",
            "v3.4.2",
            "v3.4.1",
            "v3.4.0",
            "v3.3.1",
            "v3.3.0",
            "v3.2.1",
            "v3.2.0",
            "v3.1.0",
            "v3.0.1",
            "v3.0.0",
            "v2.2.0",
            "v2.1.0",
            "v2.0.1",
            "v2.0",
            "v1.13.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31186.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:33.017977989Z",
      "provider": "osv",
      "references": [
        "https://next-auth.js.org/configuration/options#logger",
        "https://next-auth.js.org/getting-started/upgrade-v4",
        "https://next-auth.js.org/warnings#debug_enabled",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31186.json",
        "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-p6mm-27gq-9v3p",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-31186"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-532"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31186.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-31186",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499901,
  "published_at": "2022-08-01T19:25:24+00:00"
}