---
cve: "CVE-2022-31127"
severity: "HIGH"
cvss: 7.1
epss: "1.1%"
vendor: "nextauthjs"
kev: false
exploited: false
published: "2022-07-06 18:15:19"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-20T16:09:13+02:00"
---

# CVE-2022-31127

> 7.1 HIGH · 🧪 PoC

## Beschreibung

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail [signin endpoint](https://next-auth.js.org/getting-started/rest-api#post-apiauthsigninprovider) that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: `balazs@email.com, Before signing in, claim your money!`. This was previously sent to `balazs@email.com`, and the content of the email containing a link to the attacker's site was rendered in the HTML. This has been remedied in the following releases, by simply not rendering that e-mail in the HTML, since it should be obvious to the receiver what e-mail they used: next-auth v3 users before version 3.29.8 are impacted. (We recommend upgrading to v4, as v3 is considered unmaintained. next-auth v4 users before version 4.9.0 are impacted. If for some reason you cannot upgrade, the workaround requires you to sanitize the `email` parameter that is passed to `sendVerificationRequest` and rendered in the HTML. If you haven't created a custom `sendVerificationRequest`, you only need to upgrade. Otherwise, make sure to either exclude `email` from the HTML body or efficiently sanitize it.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Erforderlich | good |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Gering | warn |

## Patch verfügbar (OSV)

- 2adfadefdc14aad9fbd19d9534e9261f9bff8ede (Commit)
- ae834f1e08a4a9915665eecb9479c74c6b039c9c (Commit)

## Referenzen

- <https://next-auth.js.org/getting-started/upgrade-v4>
- <https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pgjx-7f9g-9463>
- <https://github.com/nextauthjs/next-auth/commit/ae834f1e08a4a9915665eecb9479c74c6b039c9c>
- <https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.9.0>
- <https://next-auth.js.org/providers/email#customizing-emails>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2022-31127) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_