CVE-2021-21310: 
JavaScript vulnerability analysis and mitigation

NextAuth.js (next-auth) is an open source authentication solution for Next.js applications that contained a critical security vulnerability (CVE-2021-21310) in versions prior to 3.3.0. The vulnerability was discovered on February 8, 2021 and affected implementations using the Prisma database adapter with the Email provider (GitHub Advisory).

The vulnerability existed in the Prisma database adapter's verification function where it checked the verification token but failed to verify the identifier (email address) associated with the token. This implementation flaw made it possible for an attacker to use a valid token assigned to one user to sign in as another user when using the Prisma adapter with the Email provider (GitHub Advisory).

The vulnerability allowed attackers to potentially impersonate other users by using a valid token assigned to one user to authenticate as another user. This only affected implementations using both the Prisma database adapter and the Email provider. Implementations using the default database adapter (TypeORM), those not using the Email provider, or those not using a database were not impacted (GitHub Advisory).

The vulnerability was patched in version 3.3.0 of next-auth. For users unable to upgrade immediately, the recommended workaround was to disable the Email provider. The fix involved properly validating both the token and the associated email identifier in the verification process (GitHub Advisory).