next-auth

Authentication for Next.js

Latest 4.24.15

NPM

78%

Total Score

Maintainer Stability

Maturity

100

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted publisher provenance is present, leaving the relationship between the source and published artifact less independently verifiable.

Repo commit activity

Only four commits were recorded in the last three months, with two active maintainers, indicating slower recent development than the long release history suggests.

Token permissions

Half of the analyzed workflows lack top-level permissions, and three workflows declare write access; this is a workflow-hardening gap, although no untrusted checkout or script injection was detected.

Vulnerabilities

Title	Versions	Severity
CVE-2026-73421 next-auth is vulnerable to Improper Authorization in versions 5.0.0-beta.0 - 5.0.0-beta.31.	5.0.0-beta.0 - 5.0.0-beta.31	Critical
CVE-2023-48309 next-auth is vulnerable to Improper Authorization in versions 0.0.0 - 4.24.5.	0.0.0 - 4.24.5	Medium
CVE-2023-27490 next-auth is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.0.0 - 4.20.1.	0.0.0 - 4.20.1	High
CVE-2022-31186 next-auth is vulnerable to Insertion of Sensitive Information into Log File in versions 0.0.0 - 3.29.9 and 4.0.0 - 4.10.2.	0.0.0 - 3.29.94.0.0 - 4.10.2	Low
CVE-2022-35924 next-auth is vulnerable to Improper Input Validation in versions 4.0.0 - 4.10.3 and 0.0.0 - 3.29.10.	0.0.0 - 3.29.104.0.0 - 4.10.3	Critical