NextAuth.js uses OAuth and OIDC for authentication, but before specific releases the anti‑CSRF state, nonce, and PKCE verifier are stored in global cookies without binding them to the originating provider. This flaw allows a token generated for one identity provider to satisfy the callback of a different provider, effectively bypassing server‑side checks. An attacker can trick a user into initiating a legitimate sign‑in flow with one provider, then use the callback from another provider to link the attacker’s account to the victim’s Auth.js user. The linked account then grants the attacker persistent sign‑in, constituting a full account takeover. The weakness is a cross‑component trust flaw (CWE‑345/346) accompanied by improper secure cookie handling (CWE‑940).

The vulnerability affects the @auth:core package and the next-auth package in versions prior to @auth/core 0.41.3, next-auth 4.24.15, and next-auth 5.0.0‑beta.32. Applications that enable multi‑provider sign‑in and permit account linking while a user is logged in are particularly susceptible.

The CVSS score of 6.8 indicates moderate severity. Because the attack requires a same‑origin flow that the application exposes, it is not a generic cross‑site request forgery but a crafted sign‑in operation, so the probability of exploitation is not reflected in EPSS data. The issue is not listed in the CISA KEV catalog, yet a successful exploitation results in persistent compromise of user accounts. The attacker must have the victim observe the authorization request for one provider and then trigger the callback for a different provider; no additional privileges on the client or server are necessary beyond those typical for a web user.