NextAuth allowDangerousEmailAccountLinking enabled
Rule ID: vetkit.js.auth.dangerous-email-account-linking
An Auth.js / NextAuth provider is configured with allowDangerousEmailAccountLinking: true. Any account from that provider whose email matches an existing user is linked to that user, so an attacker who registers an account with the victim's email at a provider that does not verify emails signs in as the victim.
Last updated:
Suite: Security
javascript, typescript
An Auth.js / NextAuth provider is configured with allowDangerousEmailAccountLinking: true. Any account from that provider whose email matches an existing user is linked to that user, so an attacker who registers an account with the victim's email at a provider that does not verify emails signs in as the victim.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Remove allowDangerousEmailAccountLinking and let users link providers from an authenticated session, or keep it only for providers that verify email ownership (Google, GitHub primary emails) and document that decision.
References
Source: packages/engine/rules/sast/javascript.yml.
Related checks
- NextAuth Auth.js debug: true logs tokens in production
- NextAuth Auth.js hardcoded secret in source code
- JavaScript eval() with a dynamic argument: code injection
- Node.js code injection: request input loads a module
- Node.js child_process command injection from user input
- Node.js child_process exec with a dynamic command string
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.