https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T04:22:56.884940+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2022-24858 CVE-2022-24858 — Default redirect callback vulnerable to open redirects 2026-10-06T04:22:56.887036+00:00

Affected: nextauthjs next-auth

next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.