Detections
Analytics

SCA: security update for next-auth (GHSA-p6mm-27gq-9v3p)

low Tenable Cloud Security Plugin ID 417345

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - NextAuth.js is a complete open source authentication solution for Next.js applications. An information
 disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access
 privilege to obtain excessive information such as an identity provider's secret in the log (which is
 thrown during OAuth error handling) and use it to leverage further attacks on the system, like
 impersonating the client to ask for extensive permissions. This issue has been patched in `v4.10.2` and
 `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning
 for having the `debug: true` option turned on in production. If for some reason you cannot upgrade, you
 can user the `logger` configuration option by sanitizing the logs. (CVE-2022-31186)

See Also

https://github.com/advisories/GHSA-p6mm-27gq-9v3p

Plugin Details

Severity: Low

ID: 417345

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 1.7

Temporal Score: 1.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2022-31186

CVSS v3

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.9

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/6/2022

Vulnerability Publication Date: 8/1/2022

Reference Information

CVE: CVE-2022-31186

cwe: CWE-532