CVE-2023-48309

CVE-2023-48309 affects NextAuth.js applications prior to version 4.24.5 that rely on default Middleware authorization. An attacker can create a mock, unauthenticated user by manipulating a NextAuth.js-issued JWT from an interrupted OAuth flow. This vulnerability has a CVSS score of 5.3 (Medium), indicating low attack complexity and no user interaction required, but only allows for limited information disclosure (e.g., dashboard layout) without access to sensitive user data. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.