CVE-2022-31186

CVE-2022-31186 is an information disclosure vulnerability affecting NextAuth.js versions prior to v4.10.2 and v3.29.9. An attacker with log access can obtain sensitive identity provider secrets from OAuth error handling logs, potentially enabling further attacks like client impersonation. This vulnerability has a low CVSS score of 3.3, indicating a low attack complexity and impact, as it requires local access and only leads to partial confidentiality loss. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.