CVE-2022-39263

CVE-2022-39263 affects applications using the next-auth Email Provider and @next-auth/upstash-redis-adapter before version 3.0.2. The vulnerability stems from insufficient token verification in the email callback flow, where only the identifier (email) was checked, not the token. This allows an attacker who knows a victim's email and the token's expiration duration to bypass authentication. Rated 8.1 HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), this vulnerability has a network attack vector and high impact on confidentiality, integrity, and availability, but requires high attack complexity due to needing knowledge of the token's expiration. There is no evidence of active exploitation, nor are there public exploits available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, indicating low public awareness.