CVE-2022-24858: 
JavaScript vulnerability analysis and mitigation

CVE-2022-24858 is a high-severity vulnerability affecting the next-auth library versions prior to 3.29.2 and 4.3.2. The vulnerability was discovered and reported on April 6th, 2022, with a patch being produced within a few days. The issue involves the default redirect callback being vulnerable to open redirects (GitHub Advisory).

The vulnerability is classified as CWE-601 (Open Redirect). The issue exists in the default redirect callback functionality where the URL validation was insufficient, potentially allowing malicious redirects. The vulnerability affects both next-auth v3 users before version 3.29.2 and v4 users before version 4.3.2 (GitHub Advisory).

If exploited, this vulnerability could allow attackers to perform open redirect attacks, potentially leading users to malicious websites through the authentication flow (GitHub Advisory).

The vulnerability has been patched in versions 3.29.2 and 4.3.2. Users are recommended to upgrade to these versions or later. For those unable to upgrade immediately, a workaround is available by implementing a custom redirect callback that validates the URL origin against the baseUrl (GitHub Advisory).