https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:26:41.287613+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-22120 EUVD-2026-22120 2026-10-04T08:26:41.290127+00:00 EUVD-2026-22120 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21310 fkie_cve-2021-21310 2026-10-04T08:26:41.290159+00:00

NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider are impacted. Implementations using the Email provider with the default database adapter are not impacted. Implementations using the Prisma database adapter but not using the Email provider are not impacted. The Prisma database adapter was checking the verification token, but was not verifying the email address associated with that token. This made it possible to use a valid token to sign in as another user when using the Prima adapter in conjunction with the Email provider. This issue is specific to the community supported Prisma adapter. This issue is fixed in version 3.3.0.

 https://cve.radiocsirt.org/vuln/ghsa-pg53-56cg-4m8q GHSA-pg53-56cg-4m8q — Token verification bug in next-auth 2026-10-04T08:26:41.290192+00:00

Affected: npm: next-auth

### Impact

Implementations using the **Prisma database adapter** with the **Email provider** **are impacted**.

Implementations using the Prisma database adapter that are not using the Email provider are not impacted. Implementations using the default database adapter (TypeORM) with the Email provider are not impacted. Implementations not using a database are not impacted.

### Patches

This issue is fixed in 3.3.0 and newer versions.

### Workarounds

Those not able to upgrade can alternatively disable the Email provider as a workaround.

### Description

The Prisma database adapter was checking the verification token but not the identifier (the email address associated with the token). This made it possible to use a valid token assigned to one user, to sign in as another user when using the Prima adapter in conjunction with the Email provider. The defect is specific to the community-supported Prisma database adapter in versions <3.3.0 and is not present in the default database adapter (TypeORM).

*Note: The current community-supported adapter was not developed by Prisma.*

The defect was a problem in the implementation of verification function the adapter and is not directly related to Prisma.

The flaw may exist in other third party database adapters that do not check both the identifier and token values.

The design of the database adapter API may be revised in future to help reduce the likelyhood of similar defects.

### Timeline

On Monday (2021-02-08) we were notifi…

 https://cve.radiocsirt.org/vuln/gsd-2021-21310 gsd-2021-21310 2026-10-04T08:26:41.290243+00:00 gsd-2021-21310