Security readout for executives and security teams
Plain-English summary
This flaw lets an attacker place malicious HTML into the email sign-in address field so the legitimate NextAuth email sign-in message can carry phishing content. The main risk is credential theft or user deception through a trusted application email, not direct server takeover. Vendor fixes remove the unsafe email rendering.
Executive priority
Prioritize remediation where authentication emails are user-facing or brand-trusted. The business risk is phishing through a legitimate application channel, which can damage trust and support credential compromise even without server compromise.
Technical view
CVE-2022-31127 is CWE-79 in next-auth email sign-in handling. Affected versions are v3 before 3.29.8 and v4 before 4.9.0. The vulnerable flow rendered user-controlled email input in HTML verification emails. The fix stops rendering that email in the HTML body.
Likely exposure
Exposure is likely limited to Next.js applications using next-auth email sign-in on affected versions, especially deployments with custom sendVerificationRequest templates that render the email parameter into HTML.
Exploitation context
The source bundle does not show known active exploitation, and KEV is false. Exploitation requires a victim to act on phishing content delivered through the application’s legitimate email sign-in flow.
Researcher notes
The advisory describes improper handling of email input in the sign-in endpoint, mapped to CWE-79 with CVSS 7.1. The relevant remediation is version upgrade or safe handling of the email parameter in custom verification email code. Evidence for exploit-in-the-wild is not present in the supplied sources.
Mitigation direction
- Upgrade next-auth v4 deployments to 4.9.0 or later.
- Upgrade v3 deployments to 3.29.8, preferably migrate to maintained v4.
- Remove the email parameter from verification email HTML bodies.
- Sanitize the email parameter in any custom sendVerificationRequest implementation.
- Review vendor guidance before applying compensating controls.
Validation and detection
- Inventory all applications using next-auth email provider sign-in.
- Check dependency manifests and lockfiles for affected next-auth versions.
- Identify custom sendVerificationRequest implementations and email templates.
- Confirm verification emails no longer render user-controlled email input as HTML.
- Review public routes exposing the email sign-in provider.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-31127 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://next-auth.js.org/getting-started/upgrade-v4CVE reference · x_refsource_MISC
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pgjx-7f9g-9463CVE reference · x_refsource_CONFIRM
- https://github.com/nextauthjs/next-auth/commit/ae834f1e08a4a9915665eecb9479c74c6b039c9cCVE reference · x_refsource_MISC
- https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.9.0CVE reference · x_refsource_MISC
- https://next-auth.js.org/providers/email#customizing-emailsCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.